CVE-2026-85971 Progress Software Corporation CVE debrief

Who should care

Defenders and administrators responsible for MarkLogic Server installations, especially in environments with local user access, should assess exposure and prioritize remediation. This includes reviewing current log file permissions, updating affected versions, and monitoring for unauthorized access or modifications. The vulnerability's operational impact necessitates attention from security teams and operators to ensure the security and integrity of log数据.

Why it matters

CVE-2026-85971 is a high-severity vulnerability in Progress MarkLogic Server that could allow local users to read or alter log data due to overly permissive log file permissions. Defenders should prioritize remediating this vulnerability, especially in environments where local user access is a concern.

• Local users may be able to read sensitive log data
• Local users may be able to alter log data
• Remediation requires updating affected versions or adjusting log file permissions
• Verification of log file permissions and user access is necessary

Technical summary

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files. This could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs; existing logs retain their current permissions until remediated. The vulnerability's technical impact involves the potential for unauthorized access or alteration of log data by local users, emphasizing the need for prompt remediation.

Defensive priority

Defenders should prioritize remediating this vulnerability, especially in environments where local user access is a concern.

Recommended defensive actions

• Review and remediate MarkLogic Server log file permissions
• Update affected versions to 11.3.7 or 12.1.0
• Monitor log files for unauthorized access or modifications
• Verify log file permissions and user access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information from Progress Software Corporation may be necessary for comprehensive risk assessment. The vulnerability's impact is significant due to its potential for local users to read or alter log data, which could lead to unauthorized access or tampering. Further verification of log file permissions and user access is necessary to understand the full scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.