CVE-2026-85950 Progress Software Corporation CVE debrief

Who should care

Defenders responsible for Progress MarkLogic Server instances, especially those with administrative access, should assess exposure and prioritize verification and potential updates.

Why it matters

CVE-2026-85950 is a high-severity vulnerability in Progress MarkLogic Server that could allow remote attackers with administrative privileges to access sensitive authentication material. Defenders should prioritize verifying exposure, assessing the need for updates, and implementing compensating controls to limit access to authentication material.

• Potential unauthorized administrative access to Progress MarkLogic Server instances
• Possible exposure of authentication material associated with higher-privileged users
• Need for verification of instance exposure and potential updates
• Potential impact on confidentiality, integrity, and availability of MarkLogic Server data

Technical summary

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users. This flaw could potentially result in unauthorized administrative access. The vulnerability affects Progress MarkLogic Server instances, particularly those with administrative access, and defenders should prioritize verifying exposure and assessing the need for updates or compensating controls.

Defensive priority

Defenders should prioritize verifying exposure of Progress MarkLogic Server instances, especially those with administrative access, and assess the need for updates or compensating controls.

Recommended defensive actions

• Verify Progress MarkLogic Server instances for exposure, especially those with administrative access
• Assess the need for updates to Progress MarkLogic Server 12.x to 12.1.0 or later and 11.x to 11.3.7 or later
• Implement compensating controls to limit access to authentication material
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on an authorization flaw in Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7, which could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.