CVE-2026-85956: When Delegated MarkLogic Admins Step Outside Their Boundaries

Delegation is meant to shrink the blast radius of administration. In MarkLogic Server before the October 2026 fixes, one flaw did the reverse. CVE-2026-85956 allowed delegated database administrators to act on data outside the scope they had been granted.

Vulnerability overview

CVE-2026-85956 carries a CVSS v3.1 base score of 9.6 and sits in the critical band. The October 2026 MarkLogic Server bulletin describes the root cause as improper privilege management in backup and restore operations.

Mechanism and exploitation conditions

Backup and restore are operational tasks. They are frequently delegated to teams trusted with availability rather than with the contents of every database. The failure here is that the delegation was not enforced consistently. A delegated administrator could back up or restore data beyond the assigned scope.
That gap matters because these operations move data. A restore can overwrite current content with an older, attacker-influenced copy. A backup can lift protected collections into a location the same actor is able to read. Neither action requires the administrator to hold normal data-read rights, so scope checks on these operations are easy to overlook.
The precondition is a delegated administrative account, which is the kind of identity that tends to exist in several copies across teams and automation.

Impact

The principal effects are on confidentiality and integrity. Data that policy placed out of reach becomes reachable through an operational channel that security reviews rarely scrutinise. An attacker holding the delegated role also gains a staging option: exfiltrate a backup, or restore a modified copy to weaken later controls before doing anything noisier.
Progress warns that exploitation could lead to unauthorised administrative actions, unauthorised access to or modification of data, credential exposure and reduced auditability. No exploitation in the wild and no public proof-of-concept had been confirmed.

Affected products and scope

Affected releases are MarkLogic Server 12.0 through 12.0.3 and 11.0 through 11.3.6. The vendor fixed the flaw in 12.1.0 and 11.3.7. Retired releases, including 10.x, receive no fixes. Progress reports that Data Cloud customers were patched.

Exposure context

ZoomEye returned 4,545 assets matching app="MarkLogic". This is a measure of internet-visible deployments of the product, not of confirmed vulnerable hosts.

Remediation and mitigations

Patch to 12.1.0 or 11.3.7. After that, review backup and restore permissions with the same rigour applied to read rights. Confirm which roles can invoke these operations, verify that scope limits are enforced by the platform rather than by convention, and log every invocation with the identity that triggered it. Reconcile backup inventories against expectations, since an unexplained backup is the kind of artefact that outlives a clean-up.

References

• Progress MarkLogic Critical Security Alert Bulletin, October 2026
• NVD entries for the October 2026 MarkLogic bulletin, which record the severity and affected version ranges for the related CVEs
• SecurityOnline vulnerability report, October 12, 2026