MarkLogic Authorization Bug Grants Full Control to Forest Managers on Versions Below 11.3.7 and 12.1.0

Progress MarkLogic Server contains a critical authorization vulnerability that allows remote attackers to create admin accounts. Users of specific older versions face the risk of unauthorized administrative account creation.

What happened

The National Vulnerability Database records CVE-2026-85947 as a critical flaw in Progress MarkLogic Server. The issue affects 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. According to the NVD record, the weakness is categorized under CWE-269, which denotes improper privilege management.

The vulnerability resides within certain forest-management operations inside the server software. A remote attacker who already possesses forest-management privileges can exploit this authorization gap. The source material states that such an attacker could exploit this flaw to create a persistent unauthorized administrator account.

This action potentially results in complete unauthorized administrative control of the server. The NVD assigns a CVSS score of 9.9 to this vulnerability, indicating a critical severity level. No specific exploit code or active abuse was mentioned in the source material. The description does not detail specific bypass mechanisms.

Why it matters

The ability to create a persistent admin account represents a severe breach of administrative boundaries. Forest-management roles are typically restricted to specific database operations, not user administration. This flaw allows an attacker with those specific rights to gain full system control.

For organizations running MarkLogic Server, the impact is total loss of administrative integrity. Once an attacker creates an admin account, they can potentially control the server. The persistent nature of the account means the compromise remains even if the initial session ends.

The affected versions span two major release branches, 11.x and 12.x. This broad scope means many installations may still be vulnerable if they have not applied recent patches. The high CVSS score reflects the critical rating assigned by the NVD.

What to watch

• Monitor official Progress Security Advisories for confirmation of patch availability.
• Audit MarkLogic Server installations to identify versions 11.x before 11.3.7.
• Check 12.x installations for versions prior to 12.1.0.
• Review logs for unusual forest-management activity from non-admin users.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: MarkLogic Server

• Inventory all MarkLogic Server instances to determine current version numbers.
• Restrict network access to forest-management interfaces to trusted management IPs.
• Monitor for the creation of new administrator accounts by non-admin users.
• Plan to upgrade to MarkLogic Server 11.3.7 or 12.1.0 once updates are available.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which MarkLogic Server versions are affected by CVE-2026-85947?

Versions 11.x before 11.3.7 and 12.x before 12.1.0 are affected by this critical authorization flaw.

What privileges does an attacker need to exploit this vulnerability?

A remote attacker must already possess forest-management privileges to exploit the flaw and create an admin account.

Is there a fix available for this vulnerability?

The source material indicates that versions 11.3.7 and 12.1.0 are the fixed versions, implying patches exist.