MarkLogic Server Privilege Escalation: Forest Managers Can Spawn Unchecked Admin Accounts
A critical bug in older MarkLogic versions allows users with forest management rights to create unauthorized administrator accounts remotely.
Key points
- Progress MarkLogic Server versions before 11.3.7 and 12.1.0 contain a critical authorization flaw.
- Attackers with forest-management privileges can create persistent, unauthorized administrator accounts.
- The vulnerability is rated CVSS 9.9 Critical and involves CWE-269 improper privilege management.
Progress MarkLogic Server contains a severe authorization defect that allows remote attackers to escalate privileges. The flaw exists in specific forest-management operations within versions 11.x prior to 11.3.7 and 12.x prior to 12.1.0. According to the National Vulnerability Database, this issue is classified as critical with a CVSS score of 9.9.
The risk
The vulnerability stems from improper privilege management in forest-management functions. A remote attacker who already holds forest-management privileges can exploit this defect. They can create a persistent administrator account that was not authorized by the system owner. This action grants the attacker complete administrative control over the server.
Who is exposed
Organizations running Progress MarkLogic Server versions older than 11.3.7 or 12.1.0 are exposed. Any user account with forest-management rights can potentially trigger this escalation. The flaw allows for remote exploitation, meaning the attacker does not need local access. Complete unauthorized administrative control is the potential result of successful exploitation.
Cost and compliance
The National Vulnerability Database lists this issue as CVE-2026-85947. It is mapped to CWE-269, which covers improper privilege management. The CVSS score of 9.9 indicates the highest level of severity. No specific financial costs or regulatory fines are mentioned in the source material.
What to watch
Managers should verify their current MarkLogic Server versions immediately. Systems running 11.x before 11.3.7 or 12.x before 12.1.0 are vulnerable. Monitor for any new administrator accounts created without proper authorization. Check logs for unusual forest-management operations that could indicate exploitation.
What to do and how to stay safe: Progress
- Audit all MarkLogic Server installations to confirm they are version 11.3.7, 12.1.0, or newer.
- Review access logs for forest-management operations to detect unauthorized account creation attempts.
- Restrict forest-management privileges to only essential personnel to reduce the attack surface.
- Monitor for new administrator accounts that appear without corresponding change management tickets.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which MarkLogic Server versions are affected by this vulnerability?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected.
What can an attacker do with this flaw?
A remote attacker with forest-management privileges can create a persistent unauthorized administrator account.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates this flaw as Critical with a CVSS score of 9.9.
