External risk intelligence

Progress MarkLogic Server Delegated Admin Privilege Escalation Affecting Security Data

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-85956

MarkLogic Server is a database platform typically deployed within internal network zones to support applications. While it may be reachable in some environments, the vulnerability requires existing delegated database-administrator privileges, which is not a default public-facing configuration. Public internet exposure is not the standard deployment pattern for this type of database management function.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Progress MarkLogic Server that could allow an attacker with administrative privileges to access or alter sensitive data outside their designated scope. This issue affects specific versions of the MarkLogic Server software.

Database administrators could access or change unauthorized data.
Leaders should confirm if MarkLogic is used internally.
Assess potential exposure of critical security data.

Attack Path

How an attacker could exploit the issue

An attacker with delegated database administrator privileges could leverage this vulnerability to access or alter sensitive data beyond their permitted scope. This involves manipulating backup and restore operations on MarkLogic Server, potentially exposing critical information.

Requires delegated administrator privileges.
Triggered via backup/restore operations.
Risk of unauthorized data access/modification.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker with delegated database-administrator privileges could potentially access or modify sensitive data outside their authorized scope. This vulnerability impacts MarkLogic Server when supported by the advisory.

Security-critical data.
Unauthorized backup or restore operations.
Compromise of data integrity and confidentiality.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Progress MarkLogic Server could expose security-critical data if exploited by an attacker with administrative privileges. Infrastructure or database administration teams are likely responsible for managing MarkLogic Server deployments. The first practical step is to identify all MarkLogic Server instances, confirm their accessibility and business criticality, locate the accountable owner, and then plan remediation based on the assessed risk.

Database administration owns this issue.
Verify MarkLogic instance exposure and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress MarkLogic Server?

MarkLogic Server is a multi-model database platform designed to integrate, manage, and search complex data. It is widely used by enterprises to power high-performance applications that require flexible data models, such as JSON, XML, and RDF, often serving as a foundational component for large-scale information management systems.

How does CVE-2026-85956 work?

This vulnerability is classified as Improper Privilege Management (CWE-269). It means the software fails to properly enforce boundary restrictions for users with specific delegated roles. In this case, an attacker assigned the role of database-administrator can perform backup or restore tasks on databases they are not authorized to touch, effectively gaining control over data outside their intended scope.

Can any user trigger this vulnerability?

No. A basic user cannot trigger this issue. The attacker must already possess valid, delegated database-administrator privileges within the system to initiate the unauthorized backup or restore operations. If a user does not have this specific administrative access level, they cannot exploit this flaw, regardless of their other permissions.

Why is this a concern for internal MarkLogic Server instances?

Halo Surface Signal notes that while this database platform is typically tucked away in internal network zones, the risk remains significant if those internal systems are compromised. Because the vulnerability allows for the modification of security-critical data, even internal-only databases require attention if an unauthorized entity gains the necessary administrative-level access.

What is the first step to address CVE-2026-85956?

Begin by creating a comprehensive inventory of all MarkLogic Server instances running in your environment. Once you have identified these assets, coordinate with your database administration teams to determine which versions are in use and verify their current accessibility. This foundational step allows you to prioritize systems based on their business criticality and plan the necessary software updates.

References

community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.