CVE-2026-85947

Executive Summary

CVE-2026-85947 is a high-severity authorization flaw (CWE-269, improper privilege management) in Progress MarkLogic Server affecting 12.x releases before 12.1.0 and 11.x releases before 11.3.7. A remote attacker who already holds forest-management privileges can abuse certain forest-management operations to create a persistent unauthorized administrator account, leading to complete administrative control of the server. The vulnerability carries a CVSS base score of 9.9, reflecting network exploitability, low attack complexity, and high impact to confidentiality, integrity, and availability across a changed security scope.

Technical Analysis

The root cause is improper privilege management (CWE-269) within MarkLogic's forest-management operations. Forest in MarkLogic is the unit of storage that holds a subset of database documents and associated indexes; forest management is an administrative subsystem used to create, attach, detach, and otherwise operate on forests across a cluster. The NVD description states that "certain forest-management operations" fail to correctly enforce authorization boundaries, allowing a principal that legitimately possesses forest-management privileges to perform an action that should have required broader administrative rights.

The critical distinction in this CVE is the privilege escalation vector. The attacker is not unauthenticated and is not exploiting a memory-safety bug; the attacker begins with a legitimate, lower-privileged role (forest-management). Through the flawed operation, that role can be leveraged to mint a new administrator account that persists on the server. Because the resulting account is persistent, the attacker does not need to maintain the original low-privileged session, and the malicious admin identity survives restarts and normal operational changes.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) confirms: remotely reachable, low complexity, requires low privileges (consistent with the forest-management-privileged actor), no user interaction, and a changed scope (S:C) — meaning the vulnerable component can affect resources beyond its intended security authority. That scope change is exactly the signature of a privilege boundary bypass: a component authorized only for forest operations is used to affect the server-wide administrative security domain.

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE as of this report. The precise operation names, API surface, parameter names, and request formats are not disclosed in the NVD description, so the attack chain below is described at the vulnerability-class level only.

Exploitation Scenarios

The following attack chain is inferred strictly from the vulnerability class and the NVD description. No specific function names, endpoints, or parameters are asserted because the source description does not disclose them.

1. Reconnaissance and target identification. The attacker identifies an exposed MarkLogic Server instance in the affected version ranges (12.x before 12.1.0, 11.x before 11.3.7). Exposed administrative/app-services interfaces are the likely access surface for forest-management operations. The attacker must be able to authenticate to the instance (or obtain a session) with an identity that carries forest-management privileges.

2. Triggering the flawed operation. Once authenticated with forest-management privileges, the attacker invokes the vulnerable forest-management operation. The authorization check for that operation is insufficient — it does not verify that the caller holds the administrative rights that the operation's downstream effect should require. This is the CWE-269 failure.

3. Privilege escalation payload. Through the improperly authorized operation, the attacker causes the creation of a new administrator account. Because the operation is not correctly gated, the forest-management role is effectively used to write administrative state. No specific API call, query, or request body is documented in the available data; the mechanism is at the authorization-logic level. No public PoC is available.

4. Post-exploitation. The new administrator account is persistent. The attacker can now authenticate as a full administrator, obtain complete control of the server, read/modify/delete data, alter cluster configuration, and pivot to connected systems. Because the account persists, remediation requires explicitly identifying and removing the rogue account in addition to patching.

Persistence is the most operationally dangerous property here: simply patching the software will not necessarily invalidate the administrator account the attacker already created.

Impact Assessment

The CVSS base score is 9.9 (Critical). Subscore analysis:

• Confidentiality: High — a full administrator can read all databases, forests, and configuration data held by the server.
• Integrity: High — an administrator can modify or delete data and alter security configuration.
• Availability: High — administrative control allows disruption or destruction of server operation and data.
• Scope: Changed — forest-management authority is leveraged to affect the server-wide administrative domain, crossing the intended security boundary.
• Attack Vector: Network / Complexity: Low / Privileges Required: Low / User Interaction: None — the flaw is remotely exploitable with low complexity and does not depend on victim interaction, provided the attacker has a forest-management-capable identity.

Blast radius. Any MarkLogic Server 12.x before 12.1.0 or 11.x before 11.3.7 is in scope. Data platforms frequently hold regulated, high-value records, and MarkLogic deployments are often clustered, so full administrative control of one server can extend to the data and configuration it serves. Enterprise impact includes potential data breach, data destruction, compliance exposure, and loss of trust in the integrity of the platform. The exploitation prerequisite (forest-management privileges) reduces the pool of external attackers somewhat but is realistically achievable for insiders, compromised service accounts, or an attacker who has already obtained a foothold with that role.

Detection Guidance

Sigma Rule

title: Potential MarkLogic Forest-Management Privilege Escalation (CVE-2026-85947)
id: 3f9c1a2e-7b64-4d1a-9e21-cve202685947
status: experimental
description: Detects administrative account creation events following forest-management activity, consistent with CVE-2026-85947 privilege escalation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85947
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: marklogic
  service: audit
detection:
  selection_forest:
    event_type:
      - 'forest-management'
      - 'forest_create'
      - 'forest_attach'
      - 'forest_detach'
  selection_admin_create:
    event_type:
      - 'user_create'
      - 'security_account_create'
      - 'admin_create'
    role:
      - 'admin'
      - 'administrator'
  condition: selection_admin_create
falsepositives:
  - Legitimate administrative provisioning of new administrator accounts
level: high
tags:
  - attack.privilege_escalation
  - attack.t1078
  - cve.2026.85947

YARA Rule

rule CVE_2026_85947_MarkLogic_PrivEsc_Indicators
{
    meta:
        description = "Heuristic hunt rule for artifacts related to MarkLogic forest-management administrative privilege escalation (CVE-2026-85947)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85947"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $ml = "MarkLogic" ascii nocase
        $f1 = "forest-management" ascii nocase
        $f2 = "forest-management" wide nocase
        $a1 = "administrator" ascii nocase
        $a2 = "createUser" ascii nocase
        $a3 = "security-create" ascii nocase
    condition:
        $ml and (any of ($f*)) and (any of ($a*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85947 MarkLogic Forest-Management Privilege Escalation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"forest"; nocase; http.uri; content:"admin"; nocase; http.uri; content:"create"; nocase; classtype:attempted-admin; reference:cve,2026-85947; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85947; sid:202685947; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" and
      process.name : "MarkLogic" ]
  [ any where event.category == "iam" and
      event.action : ("user_created" or "account_created") and
      marklogic.role : "admin" ]

Splunk SPL Query

index=marklogic sourcetype="marklogic:audit"
| search (event_type="forest-management" OR event_type="forest_create" OR event_type="forest_attach")
    AND (event_type="user_create" OR event_type="admin_create" OR role="admin")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, role, event_type
| where count > 0
| sort - last_seen

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85947,">
  <rule id="100947" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">^(forest-management|forest_create|forest_attach|admin_create|user_create)$</field>
    <field name="role">^(admin|administrator)$</field>
    <description>CVE-2026-85947: Possible MarkLogic forest-management privilege escalation leading to admin account creation</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or OSV package data is confirmed. The version thresholds below map to the affected ranges stated in the NVD description and must be independently verified against the vendor before upgrade.

1. Immediate mitigations

   • Restrict network access to MarkLogic administrative and App Services interfaces to trusted management networks.
   • Audit all identities currently holding forest-management privileges and enforce least privilege; remove the role anywhere it is not strictly required.
   • Review existing accounts with administrator rights and investigate any that were created unexpectedly; the flaw can leave a persistent rogue admin behind.
   • Force credential rotation and review authentication logs for anomalous admin-account creation events, especially those temporally following forest-management activity.

2. Patch / upgrade steps

   • Upgrade to Progress MarkLogic Server 12.1.0 or 11.3.7 (or later) once a vendor advisory confirms the fix; verify the release note against the affected-range statement before deployment.
   • After upgrading, explicitly search for and disable any administrator accounts that were not legitimately provisioned, since patching does not retroactively remove a previously created rogue account.
   • Re-test authorization behavior for forest-management operations in a staging environment before production rollout.

3. Long-term hardening

   • Implement continuous monitoring and alerting for privileged-account creation correlated with lower-privileged role activity.
   • Adopt privileged access management (PAM) with just-in-time elevation and session recording for MarkLogic administration.
   • Enforce mandatory review of authorization logic and separation of duties for operations that can write security state.
   • Track the CVE for vendor advisory updates, CISA KEV status, and public exploit availability; re-prioritize upon any change.

References

• NVD — CVE-2026-85947: https://nvd.nist.gov/vuln/detail/CVE-2026-85947
• MITRE CWE-269 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• FIRST — EPSS (not yet scored for this CVE at time of writing): https://www.first.org/epss/
• Progress Software security advisories (verify current MarkLogic advisory): https://www.progress.com/security
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85947 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, CISA KEV entry, or confirmed exploit-in-the-wild evidence exists for this CVE per the data provided. No threat actor campaign is attributed.