Progress MarkLogic Server Authorization Flaw Allows Remote Admin Takeover

A critical authorization vulnerability in Progress MarkLogic Server allows remote attackers to seize complete administrative control of the database system. The National Vulnerability Database records the flaw as CVE-2026-85947, assigning it a CVSS score of 9.9, which indicates severe risk to affected installations. This weakness enables unauthorized account creation through specific server operations.

The vulnerability stems from an authorization flaw within certain forest-management operations in the Progress software. According to the NVD record, a remote attacker who already possesses forest-management privileges can exploit this defect. By leveraging these existing rights, the attacker can create a persistent administrator account that was not authorized by the system administrator. This action potentially results in complete unauthorized administrative control over the server, bypassing standard access restrictions.

Context and Background

The Common Weakness Enumeration categorizes this issue as CWE-269, which refers to improper privilege management. This classification highlights that the system fails to correctly restrict actions based on user permissions. In this specific case, the boundary between forest-management privileges and full administrative control is breached. The flaw allows an escalation of privileges that persists even after the initial exploitation attempt concludes.

Progress Software Corporation produces the MarkLogic Server platform, which is used for managing structured and unstructured data. The National Vulnerability Database lists the specific versions impacted by this authorization failure. The record indicates that the flaw exists in older releases of the software that have not yet received the necessary security corrections. This type of vulnerability is particularly dangerous because it allows long-term persistence within the compromised environment.

Who Is Affected

Organizations running MarkLogic Server 11.x versions prior to 11.3.7 are vulnerable to this attack vector. Additionally, any deployment using MarkLogic Server 12.x versions earlier than 12.1.0 is exposed to the same risk. The NVD record explicitly lists these version ranges as affected by CVE-2026-85947. Users of these specific releases must verify their current software version to determine if they fall within the vulnerable scope.

The impact is limited to those who have attackers with existing forest-management privileges. However, once the unauthorized administrator account is created, the attacker gains full control. This means that any system running the affected versions is at risk if an attacker can obtain or escalate to forest-management rights. The persistence of the created account ensures that the attacker retains access even if the initial exploit conditions change.

What should you do?

Security teams should immediately audit their MarkLogic Server installations to identify versions 11.x before 11.3.7 and 12.x before 12.1.0. Administrators should review logs for any unusual forest-management operations that could indicate exploitation. Access controls for forest-management privileges should be tightened to limit the number of users with these rights. Organizations should monitor for the creation of new administrator accounts that were not initiated by authorized personnel.