Progress MarkLogic Server: Improper privilege management in forest operations
Summary
Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges can create a persistent unauthorized administrator account, which may lead to complete administrative control of the server. The attacker needs a valid account with forest-management rights; no user interaction is required.
Affected
- MarkLogic Server 11.0.0 to before 11.3.7
- MarkLogic Server 12.0.0 to before 12.1.0
- Unknown whether the default configuration is affected (CNA data states unaffected by default).
Fixed in
- Fixed in 11.3.7
- Fixed in 12.1.0
- Versions 10.x and earlier are not covered by the fix and should be upgraded to a supported release.
Workaround
- Restrict forest-management privileges to trusted administrators only and remove or disable such roles for untrusted accounts.
- Review which accounts and roles hold delegated forest and database rights and the xdmp-eval-in privilege.
- Unknown: whether the vendor provides an interim hotfix.
Exploitation
- CISA KEV: not listed at the time of research.
- Public proof-of-concept exploit: none found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Vendor advises customers to install updates, as affected instances may run normally without signs of exploitation.
Our recommendation
- Identify all MarkLogic Server instances, their versions and any remote management exposure.
- Patch to 11.3.7 or 12.1.0, or upgrade unsupported versions.
- Review and minimise forest-management and administrator roles.
- Check for unexpected administrator accounts created recently.
- Apply together with the other October 2026 MarkLogic fixes listed in the vendor bulletin.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Progress MarkLogic Critical Security Alert Bulletin October 2026 community.progress.com
- OpenCVE CVE-2026-85947 app.opencve.io
- VulDB 416980 vuldb.com
- Strix CVE-2026-85947 www.strix.ai
- TheHackerWire CVE-2026-85947 www.thehackerwire.com
- Miztonlabs: Two critical MarkLogic flaws miztonlabs.org
- Cybersecuritynews: Progress MarkLogic flaws cybersecuritynews.com
- GBHackers: Critical Progress MarkLogic Server vulnerabilities gbhackers.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:33.
Original description (NVD)
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.