CVE-2026-85947 Progress Software Corporation CVE debrief

Who should care

Defenders responsible for Progress MarkLogic Server instances should assess exposure and apply patches. This vulnerability could result in complete unauthorized administrative control of the server.

Why it matters

CVE-2026-85947 is a critical vulnerability in Progress MarkLogic Server that allows remote attackers with forest-management privileges to create unauthorized administrator accounts. Defenders should assess exposure, restrict access, and apply patches immediately.

• Potential creation of unauthorized administrator accounts
• Possible complete unauthorized administrative control of the server
• Need for immediate patching and access restriction

Technical summary

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server. The vulnerability has a CVSS score of 9.9, indicating critical severity. Defenders should verify the server versions, restrict access to forest-management operations, and apply patches immediately.

Defensive priority

Immediate attention is required to assess exposure and apply patches for Progress MarkLogic Server instances. Defenders should verify the server versions and restrict access to forest-management operations.

Recommended defensive actions

• Assess Progress MarkLogic Server instances for exposure
• Restrict access to forest-management operations
• Apply patches for Progress MarkLogic Server 12.x and 11.x releases
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD provide official records of the vulnerability. Progress Software Corporation has released an advisory for this issue. The vulnerability affects Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7. The evidence is based on official CVE and NVD records, as well as a vendor advisory. Defenders should verify the server versions and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.