Vulnerability details
CVE-2026-85956
Progress Software MarkLogic Server
Improper privilege management in Progress MarkLogic Server backup and restore operations
CVSS 3.1
9.6Critical
Official description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.6Critical | 3.1 | CVEProject cvelistV5 (CNA) (ProgressSoftware) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Progress Software Corporation | MarkLogic Server | 11.0.0 ≤ v < 11.3.7 | CVEProject cvelistV5 (CNA) |
| Progress Software Corporation | MarkLogic Server | 12.0.0 ≤ v < 12.1.0 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-12
- Last updated
- 2026-10-14
- State
- Published
- Assigner (CNA)
- ProgressSoftware
- Kolun priority
- 23 · Low
Exploit prediction (EPSS)
0.39%
Probability of exploitation in 30 days
34.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-269Improper Privilege Management