CVE-2026-85956 Progress Software Corporation CVE debrief

Who should care

Defenders responsible for Progress MarkLogic Server deployments, particularly those with versions 11.x before 11.3.7 and 12.x before 12.1.0, should assess exposure and prioritize patching and verifying backup and restore operations.

Why it matters

CVE-2026-85956 is a critical vulnerability in Progress MarkLogic Server that allows remote attackers with delegated database-administrator privileges to perform unauthorized backup or restore operations, potentially leading to unauthorized access or modification of security-critical data. Defenders should prioritize patching affected versions and verifying backup and restore operations.

• Potential unauthorized access to security-critical data
• Potential modification of security-critical data
• Need to verify and apply patches for affected versions
• Need to review and ensure proper authorization and access controls for backup and restore operations

Technical summary

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope. This could result in unauthorized access to or modification of security-critical data. The vulnerability is due to improper privilege management in the backup and restore operations. A remote attacker can exploit this vulnerability to perform unauthorized actions, potentially leading to data breaches or security incidents.

Defensive priority

Defenders should prioritize verifying and applying patches for Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0. Review backup and restore operations to ensure proper authorization and access controls.

Recommended defensive actions

• Verify and apply patches for Progress MarkLogic Server versions 11.x before 11.3.7 and 12.x before 12.1.0
• Review backup and restore operations to ensure proper authorization and access controls
• Monitor for unauthorized access or modifications to security-critical data
• Perform a thorough review of system logs to identify potential security incidents
• Implement additional monitoring and logging to detect similar activities in the future
• Conduct a security audit to ensure that all database-administrator privileges are properly delegated and monitored
• Review and update incident response plans to address potential data breaches

Evidence notes

The CVE record and source item provide details on improper privilege management in Progress MarkLogic Server backup and restore operations. The vendor, Progress Software Corporation, has provided an advisory on their community site.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.