{"id":"CVE-2026-85947","published":"2026-10-12T16:17:06.040","lastModified":"2026-10-14T11:17:05.550","description":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This CVE describes an authorization flaw in Progress MarkLogic Server that allows a remote attacker with forest-management privileges to create unauthorized administrator accounts, potentially leading to complete server compromise. The vulnerability affects versions before 12.1.0 and 11.3.7.","exploitability":"Exploitation requires a remote attacker with existing forest-management privileges, making it moderately difficult but achievable since forest-management access is often granted for legitimate operational purposes.","blast_radius":"If exploited, this flaw could allow attackers to gain full administrative control over MarkLogic servers, potentially affecting all databases and data managed by the server with complete read/write/delete capabilities.","remediation":"Upgrade to MarkLogic Server 12.1.0 or 11.3.7 to remediate this authorization flaw.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["authorization","privilege-escalation","database"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:46:01.657Z"}}