CVE-2026-85971: Incorrect log file permissions in Progress MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs; existing logs retain their current permissions until remediated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user with access to the operating system can exploit the overly permissive permissions on affected log files. Remote-only users are not described as being able to exploit it directly.
Which deployments are affected?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. The issue concerns certain log files created with overly permissive default operating-system permissions.
Will upgrading correct permissions on log files that already exist?
No. The corrected default permissions apply only to newly created and rotated logs; existing logs retain their current permissions until they are separately remediated.
What should be checked after applying the fixed release?
Review permissions on existing MarkLogic log files and remediate any that remain overly permissive. Also verify that newly created or rotated logs receive the corrected default permissions.