CVE-2026-85963 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Progress MarkLogic Server versions prior to 12.1.0 and 11.x releases before 11.3.7 centers on the presence of deprecated functionality within the OpsDirector component. This legacy code path contains inherent security weaknesses that undermine the integrity of authentication mechanisms, specifically allowing for request forgery and unauthorized access patterns. The core issue stems from insufficient validation of incoming requests directed at internal services, which were originally designed with less stringent security controls in earlier iterations of the software architecture. Because this functionality is deprecated but remains active by default or through legacy configuration profiles, it presents an attack surface that has not been hardened against modern exploitation techniques.
From a technical perspective, the flaw enables unauthenticated remote attackers to interact directly with internal administrative interfaces without providing valid credentials. This capability allows for two primary malicious actions: making unauthorized requests to sensitive internal services and forging trusted requests that appear to originate from legitimate system components or administrators. The ability to forge trusted requests is particularly dangerous as it bypasses standard access control checks, allowing the attacker to execute commands or retrieve data under the guise of a privileged entity. This weakness aligns with CWE-287 Improper Authentication and CWE-345 Insufficient Verification of Data Authenticity, highlighting fundamental failures in verifying the source and legitimacy of incoming network traffic.
The operational impact of this vulnerability is significant for any organization relying on MarkLogic Server to store or process sensitive data. An unauthenticated attacker can potentially exfiltrate protected information that was intended to be restricted to authorized users only. Furthermore, by forging trusted requests, an adversary could manipulate system configurations, alter database states, or escalate privileges within the application layer. This compromises not just confidentiality but also integrity and availability of the services provided by MarkLogic Server. The risk is exacerbated in environments where OpsDirector features are enabled for monitoring purposes, as these interfaces often have broader access rights to facilitate administrative tasks if properly secured.
To mitigate this risk, organizations must ensure that their Progress MarkLogic Server installations are updated to version 12.1.0 or later, which includes the necessary patches and removal of vulnerable code paths in earlier versions like 11.3.7. If upgrading is not immediately feasible, administrators should disable the deprecated OpsDirector functionality entirely through configuration changes to remove the attack vector from exposure. Additionally, implementing network segmentation to restrict access to internal administrative interfaces can provide a layer of defense-in-depth. Security teams should also audit their configurations for any remaining legacy settings that might inadvertently enable these weak authentication mechanisms. Regular vulnerability scanning and adherence to industry standards such as MITRE ATT&CK techniques related to Initial Access and Privilege Escalation will help in identifying and remediating similar weaknesses before they can be exploited by malicious actors.