CVE-2026-85950
Received Received - Intake

Authorization Bypass in Progress MarkLogic Server

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Progress Software Corporation

Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized administrative access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-85950
EUVD
EUVD-2026-97509

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Progress Software Corporation MarkLogic Server 11.0.0
Progress Software Corporation MarkLogic Server 12.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization flaw in Progress MarkLogic Server versions before 12.1.0 and 11.3.7. A remote attacker with admin privileges could access authentication material of higher-privileged users, potentially gaining unauthorized admin access.

Impact Analysis

If you use MarkLogic Server versions before 12.1.0 or 11.3.7, an attacker with admin access could escalate privileges and perform unauthorized actions, compromising system integrity and confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information security), potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade MarkLogic Server to version 12.1.0 or later if using 12.x, or to 11.3.7 or later if using 11.x. This addresses the authorization flaw by patching the underlying issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85950. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart