Key points
- CVE-2026-85956 is rated CVSS 9.6 critical by the NVD.
- It affects MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7.
- Attackers with delegated database-admin privileges can access out-of-scope forests.
Progress MarkLogic Server contains a severe security flaw that allows remote attackers to bypass data boundaries. The National Vulnerability Database assigned CVE-2026-85956 a CVSS score of 9.6, classifying it as critical. This issue impacts specific older versions of the software widely used for data management.
In plain English
Imagine a librarian who is only allowed to handle books in the history section. This bug lets that librarian copy or replace books in the science section, even though they have no permission to touch them. Attackers with certain administrative privileges can perform backup or restore operations on database forests that fall outside their authorised scope.
The background
The vulnerability stems from improper privilege handling within the MarkLogic Server architecture. According to the NVD record, the weakness is classified under CWE-269, which relates to improper privilege management. This allows a remote attacker who has been granted delegated database-administrator privileges to execute actions that should be restricted to higher-level administrators or specific database contexts.
What changes now
Organisations running affected versions are exposed to potential unauthorised access or modification of security-critical data. The flaw exists in Progress MarkLogic Server 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. Until users upgrade to the patched versions, the risk of data leakage or corruption remains high for any system using these older builds.
What to do and how to stay safe: MarkLogic Server
- Inventory all servers running MarkLogic Server to identify versions 12.x before 12.1.0 and 11.x before 11.3.7.
- Review access logs for unusual backup or restore operations performed by accounts with delegated database-administrator privileges.
- Restrict network access to administrative interfaces to prevent remote exploitation until patches are applied.
- Verify that database-administrator privileges are granted only to essential personnel on a need-to-know basis.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of MarkLogic Server are vulnerable to CVE-2026-85956?
The flaw affects MarkLogic Server 12.x releases before version 12.1.0 and 11.x releases before version 11.3.7.
What can an attacker do with this vulnerability?
A remote attacker with delegated database-administrator privileges can perform backup or restore operations on forests outside their authorised database scope.
Is this vulnerability considered critical?
Yes, the National Vulnerability Database rates CVE-2026-85956 as critical with a CVSS score of 9.6.
