CVE-2026-85956

Executive Summary

CVE-2026-85956 is a privilege-escalation vulnerability in Progress MarkLogic Server that allows a remote, authenticated attacker holding delegated database-administrator privileges to perform backup or restore operations on forests outside their authorized database scope. This scope-bypass enables unauthorized read and modification of security-critical data across the server. The flaw affects MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7, and carries a CVSS v3.1 base score of 9.6 (Critical), reflecting high confidentiality and integrity impact with changed scope, though availability is unaffected.

Technical Analysis

The vulnerability is classified as CWE-269 (Improper Privilege Management). The root weakness is an authorization-scope enforcement failure: the platform delegates database-administrator capabilities to lower-trust accounts, but the backup and restore operations invoked by these accounts do not validate that the target forests belong to the database(s) within the delegated scope. As a result, a remote attacker who possesses a valid delegated database-administrator role can direct backup or restore actions at forests attached to databases the account was never authorized to administer.

The attack surface is the administrative interface/API of MarkLogic Server through which backup and restore operations are requested. The CVSS vector AV:N (network reachable), AC:L (no unusual preconditions), PR:L (requires a low-privilege authenticated account), UI:N (no user interaction), and S:C (the successful exploit crosses a security authority boundary — the delegated admin exercises control beyond the intended authorization scope) confirms the issue is a horizontal/vertical privilege-management failure rather than a memory-safety or injection flaw. The C:H and I:H ratings reflect that reachable, out-of-scope forests may contain security-critical configuration or access-control data; A:N indicates the technique does not inherently degrade availability.

Because the NVD description does not disclose specific API endpoints, parameter names, or code paths involved in the backup/restore authorization check, no such implementation detail can be asserted. The defensible characterization is that the missing control is a scope check on the forest target of a backup/restore request. No public PoC, exploit code, or Nuclei template exists as of this writing.

Exploitation Scenarios

No public PoC available; the attack chain below is inferred from the vulnerability class (improper privilege management in delegated administrative operations) and the NVD description.

1. Reconnaissance / target identification: The attacker identifies a reachable MarkLogic Server instance (e.g., via administrative service ports) and confirms the version falls in the affected ranges (12.x < 12.1.0 or 11.x < 11.3.7). The attacker also needs an existing account with delegated database-administrator privileges — this may be a legitimate low-trust operator account or one obtained through prior compromise of a lower-privileged user.

2. Triggering the flaw: Using the delegated database-administrator account, the attacker initiates a backup or restore operation but specifies a forest that is outside the database(s) the account is authorized to manage. Because the scope check is missing, the server does not reject the request based on forest ownership. This is a logic/authorization bypass, not an injection or code-execution primitive.

3. Payload / execution method: At the vulnerability-class level, the attacker supplies a target forest reference that should be rejected by authorization logic but is accepted. No specific API parameters or HTTP paths are documented; the request is carried over the network to the administrative interface using the account's existing credentials (exploiting T1078, Valid Accounts, rather than crafting a novel exploit).

4. Post-exploitation impact: A successful out-of-scope restore can overwrite or inject data structures in a forest the attacker should not control, and an out-of-scope backup can expose the contents of a forest the attacker should not read. This enables unauthorized access to and modification of security-critical data — potentially tampering with security configuration/credentials stored in a privileged forest — which can be leveraged to entrench access or escalate effective privileges further.

Impact Assessment

The CVSS v3.1 vector yields a base score of 9.6 (Critical): AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The single mitigating factor is PR:L — exploitation requires an already-authenticated delegated database-administrator account. In practice, delegated admin accounts are commonly provisioned to application teams, DBAs, and automated tooling, expanding the pool of potential insiders and compromised-credential holders.

Blast radius: any MarkLogic Server deployment in the affected version ranges that uses delegated database-administrator roles is exposed. Successful exploitation crosses an authorization boundary (S:C) and provides high confidentiality and integrity impact across forests that may store security-critical data — including access-control metadata and credentials. Integrity compromise of a security forest is particularly severe because it can be a stepping stone to broader, durable control of the cluster. Availability is not directly impacted (A:N), so the attack is quiet and unlikely to trigger outage-based alarms. CISA KEV status is NO and no exploit-in-the-wild evidence is available.

Detection Guidance

Detection should focus on anomalous backup/restore activity and cross-scope administrative operations. Because the flaw is a legitimate functionality misused outside designed scope, behavioral baselining of database-admin actions is essential.

Sigma Rule

title: MarkLogic Backup or Restore on Out-of-Scope Forest by Delegated Admin
id: 9f2c1a7e-8595-46c1-b3d2-202685956cve
status: experimental
description: Detects backup or restore operations targeting forests outside the authorized database scope in Progress MarkLogic Server (CVE-2026-85956).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85956
author: valtersit.com
date: 2026/01/01
logsource:
  product: marklogic
  service: audit
detection:
  selection_event:
    - event_type: 'forest-backup'
    - event_type: 'forest-restore'
    - operation: 'backup'
    - operation: 'restore'
  selection_scope:
    scope_mismatch: true
    target_forest_out_of_scope: true
  filter_authorized:
    user_role: 'admin'
  condition: selection_event and selection_scope and not filter_authorized
falsepositives:
  - Legitimate cross-database maintenance windows
  - Migration or disaster-recovery tooling operated by full administrators
level: high

YARA Rule

rule CVE_2026_85956_MarkLogic_Backup_Restore_Scope_Bypass
{
    meta:
        description = "Detects references to MarkLogic forest backup/restore operations that may indicate scope-bypass exploitation attempts in logs or scripts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85956"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $op1 = "forest-backup" nocase
        $op2 = "forest-restore" nocase
        $m1 = "MarkLogic Server" nocase
        $m2 = "databases/" nocase
        $scope = "out-of-scope" nocase

    condition:
        (uint16(0) == 0x3C3F or filesize < 5MB) and
        ($m1 or $m2) and
        ($op1 or $op2) and
        $scope
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85956 Progress MarkLogic Server out-of-scope backup/restore operation"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"forest"; nocase; http.uri; content:"backup"; nocase; http.uri; content:"forest"; nocase; http.uri; content:"restore"; nocase; threshold:type both, track by_src, count 5, seconds 60; reference:cve,2026-85956; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85956; classtype:attempted-admin; sid:202685956; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [authentication where event.outcome == "success" and user.roles : "database-administrator"]
  [network where event.action == "backup" or event.action == "restore"]
  [network where event.action == "backup" or event.action == "restore" and marklogic.forest.scope_in_authorized_set == false]

Splunk SPL Query

index=marklogic sourcetype="marklogic:audit" (event_type="forest-backup" OR event_type="forest-restore" OR operation="backup" OR operation="restore")
| stats count values(target_forest) as forests values(target_database) as databases by user_id
| where count > 0 AND mvcount(forests) > mvcount(databases)
| table _time user_id forests databases
| sort - _time

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85956,">
  <rule id="2026859" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">forest-(backup|restore)</field>
    <field name="scope_mismatch">true</field>
    <description>CVE-2026-85956: MarkLogic out-of-scope forest backup/restore operation by delegated database administrator</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>privilege_escalation,attempted_admin,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Vendor fix and workarounds are not documented in the supplied intelligence; no affected-version package data was provided by OSV.

1. Immediate mitigations:

• Restrict delegated database-administrator role assignments to the minimum necessary personnel and automate review of those assignments.
• Treat the account tier as high-value: enforce strong authentication (MFA where supported at the fronting layer), short session lifetimes, and alerting on backup/restore operations.
• Where operationally feasible, disable or tightly gate backup/restore operations for delegated-admin accounts until the scope check is corrected, and route forest maintenance through full administrators.
• Monitor audit logs specifically for cross-scope backup/restore activity as described in the Detection Guidance section.

2. Patch/upgrade steps:

• Upgrade MarkLogic Server 12.x to 12.1.0 or later.
• Upgrade MarkLogic Server 11.x to 11.3.7 or later.
• Because no patch evidence was tracked from a source, validate the fix by confirming the release notes for the target version, then retest that a delegated database-administrator account can no longer back up or restore forests outside its authorized scope.

3. Long-term hardening:

• Implement and enforce a documented authorization scope model for administrative APIs, with automated tests asserting that delegated roles cannot operate on out-of-scope forests.
• Adopt least-privilege role design, separating backup operators from full administrators.
• Centralize and retain administrative audit logs off-host; correlate backup/restore events with role and forest ownership metadata.
• Track the vendor advisory channel for the formal fixed-version confirmation and any CVE-specific guidance that augments this report.

References

• NVD — CVE-2026-85956: https://nvd.nist.gov/vuln/detail/CVE-2026-85956
• CWE-269 (Improper Privilege Management): https://cwe.mitre.org/data/definitions/269.html
• CVSS v3.1 Specification (score 9.6 vector interpretation): https://www.first.org/cvss/v3.1/specification-document
• Progress MarkLogic product/advisory channel: https://www.progress.com/marklogic (check for the corresponding security advisory and fixed-version confirmation)
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• CISA KEV catalog (currently NO listing for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are known at the time of writing; EPSS has not yet scored this CVE and no public PoC, exploit code, or Nuclei template is available.