CVE-2026-85947: Improper Privilege Management in Progress MarkLogic Server Forest Operations
CVE-2026-85947 is a critical authorization flaw (CWE-269) in certain forest-management operations of Progress MarkLogic Server. The record reports a CVSS 3.1 base score of 9.9 and describes a remote attacker with forest-management privileges creating a persistent unauthorized administrator account. No confirmed exploitation appears in the sources consulted, and the record lists no fixed releases.
Overview
CVE-2026-85947 affects Progress MarkLogic Server. According to the record, an authorization flaw in certain forest-management operations lets a remote attacker holding forest-management privileges create a persistent unauthorized administrator account. The CNA is ProgressSoftware and the weakness is classified as CWE-269, Improper Privilege Management.
Impact
- The record describes persistent unauthorized administrator access.
- The record states this could result in complete unauthorized administrative control of the server.
- The record reports a CVSS 3.1 base score of 9.9 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
The vector notation indicates a network-reachable attack with low complexity, low privileges required, no user interaction, a scope change, and high impact to confidentiality, integrity and availability. This reading is our inference from the standard CVSS notation.
Affected products and versions
- Product: Progress Software Corporation MarkLogic Server.
- Ranges listed in the record: 11.0.0 or later and before 11.3.7; 12.0.0 or later and before 12.1.0.
- The description refers to 12.x releases before 12.1.0 and 11.x releases before 11.3.7.
- Whether releases before 11.0.0 or other branches are affected is unknown from the record.
Exploitation status
No confirmed exploitation appears in the sources consulted. The record shows no CISA KEV listing (listed: false). The EPSS probability is 0.00349 with a percentile of 0.26718, dated 2026-10-13. EPSS is a predictive estimate and is not evidence of exploitation.
Remediation and mitigation
- The record lists no fixed versions. Check the Progress MarkLogic critical security alert bulletin to confirm the release to deploy.
- Based on the stated affected ranges, moving to 12.1.0 or later on the 12 line, or to 11.3.7 or later on the 11 line, is the likely direction (inference from the record's thresholds).
- Until patched, review which accounts hold forest-management privileges and reduce them to the minimum necessary.
- Audit existing administrator accounts for entries that were not expected.
Detection guidance
- Review the administrator account list and recent account creation events for accounts not tied to an approved change.
- Review audit records of forest-management activity performed by unexpected or non-administrative accounts.
- Treat unexpected administrator accounts as a possible compromise and follow your incident response process.
Limitations of the available information
- The record does not list fixed versions, patch identifiers or technical details on the vulnerable operations.
- The specific forest-management operations involved are not identified in the record.
- The record is marked Awaiting Analysis, so NVD and CNA details may change.
- Exposure of releases outside the listed ranges is unknown.
Frequently asked questions
Is CVE-2026-85947 being actively exploited?
No confirmed exploitation appears in the sources consulted, and the record shows no CISA KEV listing. The EPSS score is a predictive estimate, not evidence of attacks.
Which MarkLogic Server versions are affected?
The record lists 11.0.0 or later before 11.3.7, and 12.0.0 or later before 12.1.0. Releases outside these ranges are not described as affected in the record.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.