CVE-2026-85956: Progress MarkLogic Server - improper privilege management in backup and restore

Overview

CVE-2026-85956 is a critical improper privilege management issue (CWE-269) in backup and restore operations of Progress MarkLogic Server. According to the record, a remote attacker who already holds delegated database-administrator privileges can run backup or restore operations on forests outside the database scope they are authorized for. The record was published on 2026-10-12 and its source status is Awaiting Analysis.

Impact

• The description states that the flaw could lead to unauthorized access to, or modification of, security-critical data.
• Progress Software reports a CVSS 3.1 base score of 9.6 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, which indicates high confidentiality and integrity impact and no stated availability impact.
• The record does not describe the specific data exposed or the business consequences in a given deployment.

Affected products and versions

• Product: Progress Software Corporation MarkLogic Server.
• Listed affected ranges: 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0.
• The description names 12.x releases before 12.1.0 and 11.x releases before 11.3.7 as affected, which matches the listed ranges.
• The record does not list any fixed version. The boundary versions 11.3.7 and 12.1.0 are the first ones outside the stated ranges, which is an inference from the ranges and not a vendor statement about a patch.

Exploitation status

• The CISA KEV catalog does not list this CVE in the record, so active exploitation is not confirmed by that source.
• No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00309 (percentile 0.21957), dated 2026-10-13, which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

• Review the vendor advisory linked from the record and identify MarkLogic Server instances within the affected ranges.
• Plan an upgrade to a release outside the affected ranges, as indicated by the vendor. Confirm the exact fixed release in the vendor advisory before changing production systems.
• Until patched, reduce the number of accounts holding delegated database-administrator privileges and review whether each delegation is still needed.
• Restrict who can run backup and restore operations and separate those duties from general administrative roles where possible.

Detection guidance

• Review audit and administrative logs for backup and restore operations, especially those that target forests that the requesting account does not normally manage.
• Review recent changes to delegated administrator roles and check for unexpected grants.
• Monitor for unusual volumes or timing of backup and restore activity.

Limitations of the available information

• The record contains no fixed-version list, no vendor patch details beyond the advisory link, and no technical details beyond the description.
• The CVSS score and vector are reported by Progress Software and the CNA, and no independent NVD analysis is included in the record.
• The exact scope of data reachable through the flaw is not described.
• The record's status is Awaiting Analysis, so the information may change.

Frequently asked questions

What is CVE-2026-85956?

It is an improper privilege management flaw in backup and restore operations of Progress MarkLogic Server. A remote attacker with delegated database-administrator privileges could act on forests outside their authorized scope.

Which versions are affected?

The record lists the ranges 11.0.0 to before 11.3.7 and 12.0.0 to before 12.1.0. Check the vendor advisory to confirm the exact fixed release.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.