CVE-2026-85947: CWE-269: Improper Privilege Management in Progress Software Corporation MarkLogic Server

CVE-2026-85947 is an authorization vulnerability in Progress Software Corporation's MarkLogic Server affecting versions >=11.0.0 <11.3.7 and >=12.0.0 <12.1.0. The flaw exists in certain forest-management operations, where a remote attacker possessing forest-management privileges can exploit the issue to create a persistent unauthorized administrator account. This escalation of privileges could lead to complete administrative control over the server. The vulnerability is categorized under CWE-269 (Improper Privilege Management) and has a CVSS v3.1 base score of 9.9, indicating critical impact on confidentiality, integrity, and availability.

Successful exploitation allows a remote attacker with forest-management privileges to escalate their access by creating a persistent unauthorized administrator account. This results in complete unauthorized administrative control of the MarkLogic Server, compromising confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until an official fix is released, restrict forest-management privileges to trusted administrators only and monitor for suspicious account creation activities related to administrative roles.