CVE-2026-85949

Executive Summary

CVE-2026-85949 is an information disclosure vulnerability in Progress MarkLogic Server where, under certain configurations, security-sensitive information is written into diagnostic logs. MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. An attacker who gains read access to those logs can recover the leaked material and leverage it to obtain unauthorized access to protected resources, resulting in potential high integrity and availability impact (CVSS 8.1).

Technical Analysis

The vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File). Progress MarkLogic Server is a multi-model NoSQL database platform, and its diagnostic logging subsystem captures operational and troubleshooting data that administrators rely on for support and health monitoring.

Per the NVD description, under certain configurations the server records security-sensitive information into diagnostic logs. The description does not enumerate which specific data elements are logged, which configuration flags trigger the behavior, or which log destinations are affected. Those specifics are not present in the supplied intelligence and should not be assumed.

What can be stated from the vulnerability class:

• Log file channel is the exposure vector. Rather than transmitting secrets over the network or exposing them through an API response, the flaw causes sensitive material to persist in a file that may be broadly readable — by support staff, log aggregation pipelines, backup systems, or any principal able to read the diagnostic output.
• Configuration-dependent trigger. The wording "under certain configurations" implies the logging behavior is not universal; specific server, logging, or security settings must be in effect for sensitive material to be written.
• Credential/secret material as the presumed payload. Because the stated consequence is "unauthorized access to protected resources," the leaked content functions as an authentication or authorization artifact — for example credentials, tokens, or comparable protected values. The exact category is not specified in the source data.

Attack surface considerations: diagnostic logs on a MarkLogic deployment are typically accessible to operators, monitoring systems, and centralized log collectors. The exposure therefore scales with log propagation — the more destinations a log line reaches, the wider the blast radius of a single sensitive entry. MarkLogic's native port range (commonly 8000/8001 for administrative interfaces) is relevant for reconnaissance of exposed instances, though this CVE itself concerns log content rather than a remotely reachable request path.

CVSS 3.1 vector analysis: AV:N (attack may originate over a network, e.g., via a remotely reachable log store or log-forwarding service), AC:L (no special conditions beyond the configuration in play), PR:L (the attacker requires some prior access — the ability to read the logs), UI:N (no user interaction), S:U (impact confined to the vulnerable component's security scope), C:N (the vulnerability does not directly expose data to the attacker in the classic confidentiality sense at scoring time), I:H and A:H (leaked access material enables high integrity and availability impact on protected resources).

The base score of 8.1 reflects the combination of network reachability, low attack complexity, and high integrity/availability consequences once the leaked material is weaponized.

Exploitation Scenarios

Note: No public PoC or exploit code exists for this CVE. The attack chain below is inferred strictly from the CWE-532 class and the NVD description; no specific function names, endpoints, or parameters are asserted because none are provided.

1) Reconnaissance / target identification The attacker identifies an organization running an affected MarkLogic Server release (12.x < 12.1.0 or 11.x < 11.3.7). Identification may occur through version banners, exposed administrative ports, asset inventories, or knowledge of the target's technology stack. The attacker also needs a route to the diagnostic logs — a readable log volume, a shared filesystem, a log aggregation platform, an exposed support bundle, or a backup that includes log data.

2) Triggering the flaw The flaw is not triggered by the attacker in the usual sense. The vulnerable server, under the specific affected configuration, writes security-sensitive information into diagnostic logs during normal operation. The attacker's action is to read that output, not to cause it. This means exploitation depends on (a) the deployment being in the vulnerable configuration (high-level detail: the configuration condition is not enumerated in the supplied data), and (b) the attacker having read access to the resulting log files or log streams.

3) Payload / execution method At the vulnerability-class level: the attacker extracts the sensitive material from the log entries. Because the leaked content is described as usable "to obtain unauthorized access to protected resources," the extraction step yields an authentication or authorization artifact that the attacker can then replay or reuse. No specific tooling or technique is documented; this is credential-material harvesting from log output.

4) Post-exploitation impact Armed with the harvested material, the attacker authenticates to or otherwise authorizes against protected resources that the material grants access to. Per the CVSS subscores, the downstream effect is high integrity (I:H) and high availability (A:H) impact. Availability impact implies the attacker could disrupt or disable protected services or data once inside; integrity impact implies unauthorized modification. Confidentiality is scored None, which is consistent with the vulnerability's direct mechanism being log exposure rather than bulk data exfiltration of the database itself.

Realistic vectors for log access include: insider or contractor with log read permissions; compromise of a log aggregation or SIEM platform; exposure of a support bundle; over-broad backup access; or a log store reachable over the network (consistent with AV:N).

Impact Assessment

• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H — Base 8.1 (High).
• Confidentiality (C:N): The vulnerability itself does not directly leak database contents; the leak is of security-sensitive material within logs.
• Integrity (I:H): Harvested access material can enable unauthorized modification of protected resources.
• Availability (A:H): Successful unauthorized access can disrupt or disable protected resources.
• Privileges required (PR:L): The attacker needs a foothold sufficient to read logs — not an anonymous external actor.
• Scope (S:U): Impact is contained within the vulnerable component's authorization boundary as scored.

Business impact: A single sensitive log entry can compromise downstream protected resources. Organizations with centralized logging — where diagnostic logs are shipped to SIEMs, cloud log stores, or third-party support platforms — have the largest blast radius, because the leaked material is duplicated across every log destination. Compliance frameworks that govern secrets handling, log hygiene, and access to production telemetry are directly implicated. Because the CVSS integrity and availability subscores are both High, a successfully leveraged leak should be treated as a potential path to privileged access rather than a minor information disclosure.

Affected systems: All MarkLogic Server 12.x deployments below 12.1.0 and all 11.x deployments below 11.3.7 that operate in the affected configuration.

Detection Guidance

Sigma Rule

title: Suspicious Access to MarkLogic Diagnostic Logs
id: 6b2f9c41-7d3a-4e18-a5c2-0f9e1d8b7a63
status: experimental
description: Detects anomalous read access to MarkLogic Server diagnostic log files that may indicate harvesting of security-sensitive information (CVE-2026-85949).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85949
author: valtersit.com
date: 2026-01-01
logsource:
  category: file_access
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - 'MarkLogic'
      - 'marklogic'
      - 'ErrorLog'
      - 'DiagnosticLog'
  selection_ext:
    TargetFilename|endswith:
      - '.log'
      - '.txt'
      - '.zip'
  filter_service_account:
    User|contains:
      - 'marklogic'
      - 'svc-marklogic'
  condition: selection_path and selection_ext and not filter_service_account
fields:
  - User
  - TargetFilename
  - Image
falsepositives:
  - Authorized administrator or support engineer log review
  - Log rotation or backup processes
level: medium
tags:
  - attack.t1552
  - cwe.532

YARA Rule

rule CVE_2026_85949_MarkLogic_Log_Secret_Exposure
{
    meta:
        description = "Detects MarkLogic diagnostic logs that may contain security-sensitive information leaked per CVE-2026-85949"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85949"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ml1 = "MarkLogic" nocase
        $ml2 = "Diagnostic" nocase
        $log1 = "ErrorLog" nocase
        $sec1 = "password" nocase
        $sec2 = "credential" nocase
        $sec3 = "authorization" nocase
        $sec4 = "Bearer " ascii
        $sec5 = "secret" nocase
        $sec6 = "token" nocase

    condition:
        filesize < 128MB and
        ( $ml1 or $ml2 or $log1 ) and
        ( $sec1 or $sec2 or $sec3 or $sec4 or $sec5 or $sec6 )
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-85949 Possible MarkLogic Diagnostic Log Exfiltration"; flow:established,to_server; content:"MarkLogic"; nocase; http_uri; content:"log"; nocase; http_uri; classtype:attempted-recon; sid:202685949; rev:1; reference:cve,2026-85949; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

file where process.name != null and
  file.name : ("*MarkLogic*", "*marklogic*", "*ErrorLog*", "*DiagnosticLog*") and
  file.extension : ("log", "txt", "zip") and
  not user.name : ("marklogic", "svc-marklogic")

Splunk SPL Query

index=* (source="*MarkLogic*" OR source="*marklogic*" OR file_path="*ErrorLog*" OR file_path="*DiagnosticLog*")
| search (event_type="read" OR action="read" OR "open" OR "read_access")
| stats count min(_time) as first_seen max(_time) as last_seen by user, file_path, host, src_ip
| where count > 0 AND NOT user IN ("marklogic","svc-marklogic")
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85949,">
  <rule id="202859" level="10">
    <decoded_as>json</decoded_as>
    <field name="file_path">\.log$|\.zip$</field>
    <match>MarkLogic|marklogic|ErrorLog|DiagnosticLog</match>
    <description>CVE-2026-85949: Suspicious read access to MarkLogic diagnostic logs - possible sensitive information harvesting</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>cwe_532,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or patch reference is present in the supplied data; treat the guidance below as compensating controls pending a vendor advisory.

1) Immediate mitigations

• Restrict read access to MarkLogic diagnostic logs to the minimum set of principals. Enforce least privilege on log directories, log volumes, and support bundles.
• Reduce log propagation to third-party destinations until logging behavior has been verified against vendor guidance; every additional log sink expands the leak surface.
• Apply access controls and monitoring to log aggregation platforms and SIEMs that ingest MarkLogic diagnostic output.
• Review existing diagnostic logs for any security-sensitive strings and purge/rotate them per policy.
• Isolate exposed MarkLogic administrative interfaces (commonly ports 8000/8001) from untrusted networks.

2) Patch/upgrade steps

• Upgrade MarkLogic Server 12.x deployments to 12.1.0 or later, and 11.x deployments to 11.3.7 or later — the versions named in the NVD description as the remediation boundary for the affected branches.
• Consult the Progress MarkLogic security advisory for the authoritative fix, CVE mapping, and any configuration-specific guidance before scheduling the upgrade.
• After upgrading, validate that diagnostic logging no longer emits the sensitive material in the previously affected configurations.

3) Long-term hardening

• Establish log hygiene standards that prohibit secrets, credentials, and tokens from entering diagnostic output; enforce via code review and automated log-content scanning.
• Adopt secret-management practices so that protected resources do not depend on artifacts that could appear in logs.
• Monitor log access as a first-class security signal, not just a troubleshooting resource (see detection rules above).
• Maintain a vulnerability management cadence that tracks MarkLogic releases against advisories.

References

1. NVD — CVE-2026-85949: https://nvd.nist.gov/vuln/detail/CVE-2026-85949
2. CWE-532 — Insertion of Sensitive Information into Log File: https://cwe.mitre.org/data/definitions/532.html
3. MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
4. Progress MarkLogic Security Advisories portal: https://www.progress.com/security (vendor advisory for authoritative patch guidance)
5. CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document

Exploitation status: No public PoC, exploit code, or Nuclei template is known for this CVE. CISA KEV: not listed. EPSS: not yet scored by FIRST.org. No documented threat actor campaigns or exploit-in-the-wild evidence are associated with this vulnerability at time of writing.