CVE-2026-85956: CWE-269: Improper Privilege Management in Progress Software Corporation MarkLogic Server

This vulnerability (CVE-2026-85956) in MarkLogic Server allows a remote attacker who already has delegated database-administrator privileges to bypass intended access controls. Specifically, the attacker can execute backup or restore operations on database forests beyond their authorized scope. This flaw is due to improper privilege management (CWE-269) and affects versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0. The CVSS 3.1 base score is 9.6, indicating critical severity with high confidentiality and integrity impact but no availability impact.

An attacker with delegated database-administrator privileges can access or modify security-critical data outside their authorized scope by performing unauthorized backup or restore operations on forests. This can lead to significant confidentiality and integrity breaches within affected MarkLogic Server deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the data, users should monitor Progress Software Corporation advisories for updates. Until a fix is available, restrict delegated database-administrator privileges to trusted users only and review access controls carefully.