CVE-2026-85947 — Improper privilege management in Progress MarkLogic Server forest operations

CVE-2026-85947

Improper privilege management in Progress MarkLogic Server forest operations PUBLISHED

Description (CNA)

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.

Affected (CNA)

Vendor / product	Versions
Progress Software Corporation / MarkLogic Server	affected 11.0.0 before 11.3.7; affected 12.0.0 before 12.1.0

CWE

CWE-269

References

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.