Critical Flaw in MarkLogic Server Lets Admins Access Data Outside Scope

The National Vulnerability Database has published details for CVE-2026-85956, a critical security flaw in Progress MarkLogic Server. The vulnerability allows remote attackers with specific administrative privileges to access or modify data outside their authorized scope. This issue affects older versions of the software.

The flaw is classified as CWE-269, indicating improper privilege management. According to the NVD record, the vulnerability enables a remote attacker who possesses delegated database-administrator privileges to execute backup or restore operations. These operations can target forests that lie outside the authorized database scope defined for that user. Such actions could lead to unauthorized access to or modification of security-critical data stored within the system.

Technical Context and Severity

The National Vulnerability Database assigns a CVSS score of 9.6 to this vulnerability, marking it as critical. This high severity rating reflects the potential impact on confidentiality, integrity, and availability of the affected systems. The weakness involves improper privilege management as defined by CWE-269.

Attackers do not need full system administrator access to exploit this flaw. Instead, they require delegated database-administrator privileges. Once an attacker obtains these rights, they can manipulate data in forests that are not part of their designated database scope. This bypasses intended security boundaries and exposes sensitive information to unauthorized parties.

Affected Versions and Scope

Progress Software Corporation is the vendor responsible for MarkLogic Server. The vulnerability impacts specific release lines of the product. Users running MarkLogic Server 11.x versions earlier than 11.3.7 are affected by this issue. Similarly, users running MarkLogic Server 12.x versions earlier than 12.1.0 are also vulnerable.

Organizations using these older versions should review their deployment status immediately. The flaw exists in the core functionality related to database administration and forest management. The source material lists affected versions as those before 11.3.7 and before 12.1.0. Users who have not updated to these versions remain at risk of exploitation.

What should you do?

Security teams should audit their MarkLogic Server environments to identify any instances running vulnerable versions. Inventory checks should focus on the specific version numbers cited in the NVD record. Organizations should also review the privileges assigned to database administrators to ensure least-privilege principles are enforced. Monitoring logs for unusual backup or restore activities can help detect potential exploitation attempts.