CVE-2026-85950: CWE-269: Improper Privilege Management in Progress Software Corporation MarkLogic Server

CVE-2026-85950 is an authorization vulnerability in Progress Software Corporation's MarkLogic Server affecting versions 11.x prior to 11.3.7 and 12.x prior to 12.1.0. The flaw involves improper privilege management (CWE-269) that could allow a remote attacker, who already has administrative privileges, to access authentication credentials associated with users of higher privilege levels. This exposure could escalate privileges further, potentially resulting in unauthorized administrative access. The vulnerability has a CVSS v3.1 base score of 8.4, reflecting high impact on confidentiality, integrity, and availability. There is no indication of known exploits in the wild. No patch links or vendor advisory details are provided in the input data.

An attacker with administrative privileges on affected MarkLogic Server versions could exploit this flaw to access authentication materials of higher-privileged users. This could lead to unauthorized administrative access, compromising confidentiality, integrity, and availability of the system. The vulnerability is rated high severity with a CVSS score of 8.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Progress Software's advisories for updates. Until a fix is available, restrict administrative access to trusted personnel only and consider additional access controls to limit privilege escalation risks.