CVE-2026-85947: Forest-Management Rights Let Attackers Create Admin Accounts in MarkLogic Server
A critical vulnerability in Progress MarkLogic Server allows attackers with forest-management rights to create unauthorized administrator accounts and seize full control.
Key points
- CVE-2026-85947 carries a CVSS score of 9.9, rated as critical severity.
- The flaw affects MarkLogic Server 11.x versions prior to 11.3.7 and 12.x versions prior to 12.1.0.
- Attackers can create persistent, unauthorized administrator accounts through forest-management operations.
Progress MarkLogic Server contains a critical authorization flaw that allows remote attackers to gain complete administrative control. The vulnerability, tracked as CVE-2026-85947, affects specific versions of the database management system. Security researchers have assigned it a CVSS score of 9.9, indicating severe risk. The issue stems from improper handling of permissions during certain forest-management tasks.
In plain English
The flaw exists in how the server handles authorization for forest-management operations. An attacker who already holds forest-management privileges can exploit this weakness. By doing so, they can create a new administrator account that persists on the system. This new account operates without proper authorization checks. Consequently, the attacker gains full administrative control over the server. This elevation of privilege bypasses standard security boundaries.
The background
The affected software is Progress Software Corporation MarkLogic Server. The vulnerability impacts version 11.x releases before 11.3.7. It also affects version 12.x releases before 12.1.0. The weakness is categorized under CWE-269, which relates to improper privilege management. The National Vulnerability Database record confirms the scope and severity. No other products from Progress are mentioned in this specific advisory.
What changes now
Organizations using these versions must assess their exposure immediately. The ability to create persistent admin accounts poses a significant risk. Attackers do not need initial administrative rights to exploit this. They only require forest-management privileges. Once an unauthorized account is created, the attacker can maintain access. This persistent foothold allows for long-term compromise of the server environment.
What to do and how to stay safe: MarkLogic Server
- Audit all user accounts to ensure no unauthorized administrators have been created recently.
- Review logs for forest-management operations to identify potential exploitation attempts.
- Restrict forest-management privileges to only those users who strictly require them.
- Monitor for unexpected account creation events on MarkLogic Server instances.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of MarkLogic Server are affected by CVE-2026-85947?
Versions 11.x before 11.3.7 and 12.x before 12.1.0 are affected.
What is the CVSS score for this vulnerability?
The CVSS score is 9.9, which is rated as critical.
What privileges are needed to exploit this flaw?
An attacker needs forest-management privileges to exploit the authorization flaw.
