MarkLogic Critical Bug 9.9 CVSS: Forest Managers Spawn Persistent Admin Accounts in Pre-11.3.7, 12.1.0

Progress MarkLogic Server contains a severe authorization deficiency that permits remote attackers to escalate privileges. According to the National Vulnerability Database, versions prior to 11.3.7 and 12.1.0 are vulnerable to this exploit.

What is the technical nature of the vulnerability?

The National Vulnerability Database identifies CVE-2026-85947 as an authorization flaw within specific forest-management operations. The weakness is classified under CWE-269. It allows a remote attacker who already possesses forest-management privileges to bypass standard security controls.

This bypass enables the creation of a persistent, unauthorized administrator account. The NVD description states this action can result in complete unauthorized administrative control of the server. The flaw is inherent in the software’s handling of these specific management tasks.

Which software versions are affected by this issue?

Progress Software Corporation’s MarkLogic Server is affected in two major release lines. The vulnerability exists in all 11.x releases that precede version 11.3.7. It also affects all 12.x releases that precede version 12.1.0.

Organizations running any version older than these thresholds are exposed. The NVD record explicitly lists "before 11.3.7" and "before 12.1.0" as the affected ranges. No other product lines are mentioned in the source material.

Why is the risk rating so high?

The National Vulnerability Database assigns a CVSS score of 9.9 to this vulnerability. This score places the issue in the critical severity category. The high rating reflects the potential for complete unauthorized administrative control.

An attacker does not need to breach the network perimeter from scratch. They only need to obtain forest-management privileges first. Once those rights are secured, the authorization flaw allows them to create an admin account with full server access.

What is the current status of remediation?

The source material provides details on the vulnerability and affected versions but does not confirm the availability of a patch. Security teams should monitor vendor communications for updates. No fix has been confirmed yet in the provided records.

What to do and how to stay safe: Progress

• Audit all MarkLogic Server instances to identify versions below 11.3.7 and 12.1.0.
• Review access logs for any forest-management operations that may indicate exploitation.
• Restrict forest-management privileges to the minimum number of necessary accounts.
• Monitor for the creation of new administrator accounts by users with limited rights.

Step-by-step guide: Vulnerability Scanning: What It Finds and What It Misses

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-85947?

It is a critical authorization flaw in Progress MarkLogic Server that allows remote attackers to create unauthorized admin accounts.

Which versions of MarkLogic Server are vulnerable?

Versions before 11.3.7 and versions before 12.1.0 are affected by this vulnerability.

What is the CVSS score for this issue?

The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.9.