CVE-2026-85956

#NØØT Security Alerts 🚨 #ALERT — CRITICAL MARKLOGIC FLAW ALLOWS UNAUTHORIZED CROSS-DATABASE BACKUP AND RESTORE OPERATIONS October 12, 2026

DISCLOSED BY: Progress Software Corporation

PRODUCT: MarkLogic Server CVE: CVE-2026-85956 SEVERITY: CRITICAL — CVSS 9.6

AFFECTED VERSIONS: MarkLogic Server 11.0.0–11.3.6. MarkLogic Server 12.0.0 through versions before 12.1.0.

IMPACT: Improper privilege management allows attackers with delegated database-administrator privileges to perform backup or restore operations on forests outside their authorized database scope.

Successful exploitation could expose protected information or permit unauthorized modification of security-critical database content.

EXPOSURE: Requires authenticated access with delegated database-administrator privileges and network access to affected functionality.

This is NOT an unauthenticated vulnerability.

EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL AUTHORIZATION BYPASS.

No verified public working PoC or confirmed malicious in-the-wild exploitation.

Forensic triage: Review backup and restore audit records, forest ownership, administrative permissions and unexpected cross-database operations.

Investigate unauthorized changes to protected database content.

No confirmed CVE-specific IOCs published.

URGENT ACTION: Upgrade MarkLogic 11.x to 11.3.7 or later and MarkLogic 12.x to 12.1.0 or later.

Restrict management interfaces and audit delegated administrator privileges.

Investigate unauthorized backup or restore operations before trusting affected databases.

SOURCE: https://t.co/y6W408vOBS

OFFICIAL CVE: https://t.co/zcBuIwIPFA

CONFIDENCE: HIGH — Progress-authored CVE record confirms the vulnerability, affected releases, privileges required and potential impact.

Active exploitation remains unverified.

#CyberSecurity #ThreatIntel #MarkLogic #DatabaseSecurity #PrivilegeEscalation