CVE-2026-85971: CWE-732: Incorrect Permission Assignment for Critical Resource in Progress Software Corporation MarkLogic Server
Description
Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0 have a vulnerability where certain log files are assigned overly permissive operating system permissions. This misconfiguration could allow a local user to read or modify log data. The issue affects existing log files until their permissions are manually corrected, while newly created and rotated logs have corrected default permissions.
CVSS v3.1
Score 7.1high
Affected software
Progress Software Corporation
MarkLogic Server
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85971 is an incorrect permission assignment vulnerability (CWE-732) in Progress Software Corporation's MarkLogic Server. Versions 11.x prior to 11.3.7 and 12.x prior to 12.1.0 assign overly permissive OS permissions to certain log files, potentially allowing local users to read or alter log data. The fix corrects default permissions for newly created and rotated logs, but existing logs retain their permissions until remediated manually.
Potential Impact
Local users with access to the affected system could read or modify critical log files due to overly permissive permissions. This could lead to unauthorized disclosure or tampering of log data, impacting confidentiality and integrity. There is no impact on availability. The CVSS 3.1 base score is 7.1 (high severity), reflecting high confidentiality and integrity impact with low attack complexity and requiring local privileges.
Mitigation Recommendations
Upgrade to MarkLogic Server 11.3.7 or later for 11.x releases, and 12.1.0 or later for 12.x releases where the default permissions for logs are corrected. For existing log files, manually review and correct permissions to restrict unauthorized access. Since this is not a cloud service, remediation is the responsibility of the system administrator.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ProgressSoftware
- Date Reserved
- 2026-09-04T18:43:16.554Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acd13082cdf04f656b5556d
Added to database: 10/12/2026, 17:04:08 UTC
Last enriched: 10/12/2026, 17:18:21 UTC
Last updated: 10/12/2026, 17:19:14 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.