Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.
Critical 9.6
CVE-2026-85956
Progress Software MarkLogic Server — privilege escalation.
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside…
WeaknessCWE-269: Privilege escalation
Published Updated Source NVD
CVSS 3.1
9.6
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Exploit chance, 30 days
0.4%
Higher than 33% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run Progress Software MarkLogic Server, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs in Progress Software MarkLogic Server
4 more CVEs
9.6Progress Software MarkLogic Server — Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not…EPSS 0.3%9.9Progress Software MarkLogic Server — privilege escalation.EPSS 0.6%9.9Progress Software MarkLogic Server — privilege escalation.EPSS 0.4%9.9Progress Software MarkLogic Server — privilege escalation.EPSS 0.4%