CVE-2026-85947

Name of the Vulnerable Software and Affected Versions MarkLogic Server versions 11.0.0 through 11.3.6 MarkLogic Server versions 12.0.0 through 12.0.9

Description An authorization flaw exists in certain forest-management operations. A remote attacker who already possesses forest-management privileges can exploit this issue to create a persistent unauthorized administrator account, which could lead to complete administrative control of the server.

Recommendations Update MarkLogic Server versions 11.0.0 through 11.3.6 to version 11.3.7 or later. Update MarkLogic Server versions 12.0.0 through 12.0.9 to version 12.1.0 or later. Restrict access to management interfaces and review forest-management permissions.