CVE-2026-85947: Improper privilege management in Progress MarkLogic Server forest operations
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must already have forest-management privileges. No user interaction is required.
Which releases are affected?
Affected releases are MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7.
What is the impact of successful exploitation?
An attacker can create a persistent unauthorized administrator account, which may give them complete administrative control of the server.