MarkLogic Server Patch Urgent: Forest Managers Can Spawn Admin Accounts via Critical Auth Flaw in Versions Before 11.3.7

Progress MarkLogic Server contains a critical authorization flaw that allows attackers to gain full administrative control. The vulnerability affects specific versions of the database management system and enables exploitation through forest-management operations.

What happened

The National Vulnerability Database lists CVE-2026-85947 as a critical issue within Progress MarkLogic Server. The flaw exists in releases of the 12.x series prior to version 12.1.0 and the 11.x series prior to version 11.3.7. According to the NVD record, the weakness is classified under CWE-269, which relates to improper privilege management.

The authorization error occurs during certain forest-management operations within the server environment. A remote attacker who already possesses forest-management privileges can exploit this specific flaw. The attacker uses these existing rights to bypass standard security checks and create a new account. This newly created account is granted unauthorized administrator status.

The resulting administrator account is persistent, meaning it remains active even after the initial exploit is executed. The NVD description states that this action leads to complete unauthorized administrative control of the server. The vulnerability allows an attacker with forest-management privileges to create a persistent unauthorized administrator account. This account provides the attacker with full control over the server functions.

Why it matters

The CVSS score for CVE-2026-85947 is 9.9, which is rated as critical. This severity rating indicates the high impact of the vulnerability on the system. Once the unauthorized administrator account is created, the attacker has unrestricted access to the server’s functions. This includes the ability to modify data, change configurations, and access sensitive information stored in the database.

For security operations teams, this flaw represents a significant risk to database integrity. The ability to create a persistent admin account allows attackers to maintain long-term access. The flaw affects widely used versions of MarkLogic Server, including those in the 11.x and 12.x branches. Organizations running versions before 11.3.7 or 12.1.0 are directly exposed to this threat.

The NVD record confirms that these specific version ranges are affected. Users of older releases must verify their current version against the affected list. The critical nature of the flaw means that exploitation results in complete unauthorized administrative control. This level of access compromises the entire server environment.

Our take on the response

• Verify current MarkLogic Server versions against the affected ranges listed in the NVD record.
• Review audit logs for any new administrator accounts created by users with forest-management roles.
• Restrict forest-management privileges to only those who strictly require them for daily operations.
• Monitor for unusual account creation events that may indicate exploitation of CVE-2026-85947.

What to do and how to stay safe: Progress

• Audit all user accounts with forest-management privileges to ensure they are necessary and monitored.
• Check server logs for recent creation of administrator accounts, especially those linked to forest-management actions.
• Segment network access to MarkLogic Server instances to limit remote exploitation opportunities.
• Prepare to apply updates once Progress releases patches for versions 11.3.7 and 12.1.0.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of MarkLogic Server are affected by CVE-2026-85947?

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected.

What privileges does an attacker need to exploit this flaw?

The attacker must have forest-management privileges to exploit the authorization flaw and create admin accounts.

Is there a patch available for this vulnerability?

The source material does not confirm the availability of a patch or update for this vulnerability.