CVE-2026-85956: Critical Privilege Escalation in MarkLogic Server

CVSS 9.6 Critical in MarkLogic: delegated database-admins compromise forests outside authorized scope

CVE-2026-85956 affects Progress MarkLogic Server, a critical data management system used by organizations requiring structured storage and configuration security. The vulnerability allows a remote attacker with delegated database-administrator privileges to perform backup and restore operations on forests (the logical storage units in MarkLogic) outside the authorized database scope. The potential result is unauthorized access to or modification of sensitive data and security-critical configurations.

The CVSS score is 9.6, classified as Critical. The vulnerability was published on NVD on 12 October 2026. Currently, no public exploits are known. Social platform signals remain moderate (1 post in the last 24 hours), suggesting disclosure is still early. However, the critical profile makes immediate verification action prudent for IT teams responsible for MarkLogic instances.

Vulnerable versions are MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7. Administrators must inventory all MarkLogic instances in use and verify current versions. If a delegated database-administrator account is active, the risk is concrete. The fix involves immediate upgrade to patched versions. We recommend monitoring access logs to forests for backup and restore operations from delegated accounts, and reviewing privilege assignments to limit them to the necessary minimum.

At a glance

What: Privilege escalation in Progress MarkLogic Server. A remote attacker with delegated database-administrator privileges can perform backup and restore operations on forests (logical storage units) outside the authorized database scope, resulting in unauthorized access to or modification of security-critical data.
Severity: CVSS 9.6 - Critical (stated by official source)
Affected versions: MarkLogic Server 12.x before version 12.1.0 and 11.x before version 11.3.7
Fix: Update to MarkLogic Server 12.1.0 or later for 12.x series, or 11.3.7 or later for 11.x series
Status: Published on NVD on 12 October 2026. No known public exploits. Social network signals still limited (1 post in last 24 hours with minimal engagement).
Action: Inventory all MarkLogic instances in use and verify versions. If a delegated database-administrator account is active, risk is concrete. Plan immediate upgrade for environments with sensitive data. Monitor access logs to forests for backup/restore operations from delegated accounts. Review privilege assignments and limit them to the necessary minimum.

Sources: NVD, CVE-2026-85956

← All articles