CVE-2026-85959 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Progress MarkLogic Server versions prior to 12.1.0 for the 12.x branch and before 11.3.7 for the 11.x branch represents a critical deficiency in security logging mechanisms, specifically concerning the recording of successful authentication events. This issue falls under the category of insufficient audit log coverage, which is formally classified as CWE-778: Insufficient Logging. In enterprise environments where MarkLogic Server is deployed to manage large-scale data repositories and complex application workflows, robust auditing is not merely a best practice but often a regulatory requirement mandated by standards such as PCI DSS, HIPAA, and GDPR. The failure to consistently log successful login attempts creates significant blind spots in an organization's security monitoring infrastructure, undermining the ability of security operations teams to maintain situational awareness regarding who has accessed sensitive data and when.
From a technical perspective, this flaw indicates that while the authentication subsystem correctly validates credentials and grants access, it fails to emit corresponding audit trail entries for these successful events under certain conditions or configurations. This inconsistency may stem from race conditions in the logging pipeline, misconfigured log levels, or bugs within the specific version of the server software where event generation is skipped during high-load scenarios or after specific types of credential validation failures that precede a success. The absence of these logs means that an attacker who successfully compromises user credentials can operate without leaving the primary digital footprint typically associated with unauthorized access attempts. This directly impacts the integrity and availability of security monitoring systems, as they rely on comprehensive event data to detect anomalies, correlate activities across different services, and trigger alerts for suspicious behavior patterns.
The operational impact of this vulnerability is severe, particularly in environments subject to strict compliance frameworks that require proof of access controls and user activity tracking. Without consistent records of successful authentications, organizations cannot effectively perform forensic investigations following a suspected breach or insider threat incident. Security analysts are unable to reconstruct the timeline of an attacker's movement within the network, determine the scope of data exposure, or identify compromised accounts based on login timestamps and source IP addresses. This gap also hinders the implementation of zero-trust architectures that depend on continuous verification and logging of all access events to enforce least-privilege principles dynamically. Furthermore, it complicates the detection of credential stuffing attacks where an attacker might successfully guess passwords for multiple accounts; if only failed attempts are logged, the successful logins remain invisible to standard intrusion detection systems configured to alert on authentication failures rather than successes.
To mitigate this risk and align with industry best practices such as MITRE ATT&CK technique T1078: Valid Accounts, organizations must prioritize immediate patching of MarkLogic Server to version 12.1.0 or later for the 12.x branch, or version 11.3.7 or later for the 11.x branch. These updates address the underlying code defects responsible for the inconsistent logging behavior. In addition to applying vendor patches, administrators should review their current audit configurations to ensure that all relevant authentication events are explicitly enabled and directed to secure, tamper-evident log storage systems. Implementing centralized log management solutions can help mitigate some risks by providing redundancy; however, relying solely on external aggregation does not replace the need for correct application-level logging. Regular audits of security logs should be conducted to verify completeness and consistency, ensuring that no gaps exist in the recording of user activities. This proactive approach strengthens the overall defense-in-depth strategy and ensures compliance with regulatory requirements regarding access monitoring and incident response capabilities.