External risk intelligence

Progress MarkLogic Server Authorization Flaw Allows Unauthorized Administrator Account Creation.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-85947

The vulnerability exists in forest-management operations within MarkLogic Server. While these servers can be internet-facing in some deployments, the specific management functions described typically reside within administrative or internal tiers. Access requires existing management privileges, making it less likely to be directly exposed to the public internet compared to a standard web or API endpoint.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in Progress MarkLogic Server, affecting specific forest-management operations. This vulnerability could allow a remote attacker with existing management privileges to create a persistent, unauthorized administrator account, leading to a potential takeover of the server. The primary concern is to confirm if our MarkLogic Server environment is exposed and to what extent.

Unauthorized admin access could control servers.
Affects MarkLogic Server forest-management operations.
Confirm relevance and exposure of MarkLogic.

Attack Path

How an attacker could exploit the issue

An attacker with existing administrative privileges for managing forests on a MarkLogic Server could exploit this authorization flaw. By leveraging this flawed operation, the attacker could create a new, unauthorized administrator account, effectively gaining persistent control over the server. This could ultimately lead to complete administrative takeover of the system.

Entry requires existing management privileges.
Trigger involves forest-management operations.
Risk is unauthorized administrative control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker with existing forest-management privileges to create a persistent unauthorized administrator account on MarkLogic Server. When supported by the advisory, this could lead to complete unauthorized administrative control over the server, impacting its operations and the data it manages.

Server administrative control at risk.
Attacker creates unauthorized admin account.
Complete unauthorized administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for MarkLogic Server instances, likely including infrastructure or platform teams, must first identify all deployments and confirm their exposure and criticality. Ownership should be clarified with the application or system owner, followed by a risk-based remediation plan.

Identify MarkLogic Server deployments and exposure.
Confirm system criticality and accountable owner.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress MarkLogic Server?

MarkLogic Server is an enterprise-grade multi-model database engine designed to integrate and manage complex, heterogeneous data. It functions as a platform for building data-driven applications, utilizing "forests" to distribute and store large volumes of data across physical storage units. This architecture allows organizations to handle sophisticated data operations and high-performance querying.

What does CWE-269 mean for CVE-2026-85947?

CWE-269 refers to Improper Privilege Management. In the context of this vulnerability, it means the server fails to properly restrict or verify the permissions associated with specific forest-management tasks. This weakness allows a user who already possesses management-level access to go beyond their intended authority, enabling them to create unauthorized administrative accounts that should not be permissible under normal security policies.

How is this vulnerability triggered?

The flaw is triggered by invoking specific forest-management operations within the server. It is important to note that this is not a public-facing entry point; the attacker must already possess existing forest-management privileges to interact with these operations. Actions that do not involve these specific administrative management functions are not affected by this authorization bypass.

Is my server at risk?

According to Halo Surface Signal, this vulnerability resides in management functions that usually sit within internal or administrative tiers rather than public endpoints. While some deployments are internet-facing, the requirement for pre-existing management privileges significantly narrows the risk profile compared to standard web vulnerabilities. You should verify if your management interfaces are accessible beyond your internal network.

How should I respond to this threat?

Begin by auditing your environment to locate all active MarkLogic Server deployments. Once identified, establish which systems are critical and confirm who is responsible for their maintenance. Since the issue requires existing management privileges, ensure that current access controls are strictly enforced, then coordinate with the system owner to prioritize the necessary updates for your specific versions.

References

community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.