CVE-2026-85947

Summary

This CVE describes an authorization flaw in Progress MarkLogic Server that allows a remote attacker with forest-management privileges to create unauthorized administrator accounts, potentially leading to complete server compromise. The vulnerability affects versions before 12.1.0 and 11.3.7.

Exploitability

Exploitation requires a remote attacker with existing forest-management privileges, making it moderately difficult but achievable since forest-management access is often granted for legitimate operational purposes.

Blast radius

If exploited, this flaw could allow attackers to gain full administrative control over MarkLogic servers, potentially affecting all databases and data managed by the server with complete read/write/delete capabilities.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to MarkLogic Server 12.1.0 or 11.3.7 to remediate this authorization flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.