Patchfirst
Patchfirst
CVE-2026-85947 Critical · 9.9 EPSS 0.4%

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in…

Progress Software Corporation · MarkLogic Server

Summary

Progress MarkLogic Server contains an authorization flaw in certain forest-management operations, affecting 12.x releases before 12.1.0 and 11.x releases before 11.3.7. A remote attacker who already holds forest-management privileges can exploit it, without user interaction, to create a persistent unauthorized administrator account and gain complete administrative control of the server.

Official description · NVD

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.

Breakdown
16.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 12 Oct 2026. No public exploit code or confirmed exploitation is recorded.

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Not named in any threat report yet

Also mentioned in 8 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

1 link, grouped by NVD tag

Other 1

community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026
↑ ↓ chooseEnter openEsc close