CVE-2026-85958

Executive Summary

CVE-2026-85958 is an authentication validation weakness in Progress MarkLogic Server (11.x before 11.3.7 and 12.x before 12.1.0) that permits an attacker to present a token which should be rejected and have it accepted by the server, resulting in unauthorized access. The flaw is network-reachable, requires no privileges or user interaction, and carries a CVSS base score of 7.5, with full high integrity impact but no confidentiality or availability impact as scored. Organizations running unpatched MarkLogic Server deployments — typically enterprise data platforms hosting sensitive, semi-structured, and JSON/XML document stores — should prioritize upgrade to 11.3.7 or 12.1.0 and treat exposed HTTP/HTTPS administrative and application interfaces as an active risk.

Technical Analysis

The NVD description characterizes CVE-2026-85958 as an "authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server." The weakness maps to CWE-287 (Improper Authentication). This classification describes a failure in the server's token validation logic: a token presented by a client is accepted under conditions where the correct validation outcome should be rejection.

In token-based authentication, the server is responsible for verifying that a supplied token is well-formed, correctly signed or otherwise verifiable, unexpired, not revoked, and bound to the audience and issuer for which it was minted. CWE-287 covers the family of defects where one or more of these checks is absent, incorrectly ordered, or incorrectly evaluated. The practical effect in this case is an authentication bypass: the attacker does not need valid credentials (PR:N) and does not require a valid session or user interaction (UI:N). Because the affected component is reachable over the network (AV:N), the attack surface is any MarkLogic Server endpoint that accepts tokens for authentication — that is, managed application, REST, and administrative interfaces exposed on the network.

The CVSS vector (C:N/I:H/A:N) is notable. It indicates the scored impact is concentrated in integrity: the attacker can cause the server to accept and act upon requests made with an invalid token, modifying state or data under the identity associated with the improperly validated token, without the scoring framework asserting direct confidentiality loss or availability loss. In practice, for a document database holding governed enterprise data, accepted-but-invalid authentication is a precursor to data manipulation, unauthorized writes, and privilege-adjacent actions under a misrepresented identity.

The precise defect — whether it concerns signature verification, expiry handling, audience/issuer checks, token type confusion, or a fallback path that accepts malformed tokens — is not stated in the available NVD description or CNA title. No vendor advisory text, function names, parameter names, or endpoint paths were provided. Accordingly, this report describes the vulnerability at the CWE-287 class level and does not assert specific implementation details that are not present in the source data.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-85958. The attack chain below is therefore inferred at the vulnerability-class level from the CWE-287 classification and the NVD description.

1. Reconnaissance / target identification. An attacker identifies internet- or internal-network-reachable MarkLogic Server instances. MarkLogic deployments typically expose HTTP/HTTPS listeners (commonly administrative and application ports), and are discoverable through service fingerprinting, certificate inspection, and known product banners. The attacker determines that the target is running an affected version (11.x before 11.3.7 or 12.x before 12.1.0) and confirms which interfaces accept token-based authentication.

2. Triggering the flaw class. The attacker crafts or obtains a token and submits it to a token-consuming authentication path. Because the server's token validation is improper (CWE-287 per the description), the token "that should not be accepted" is accepted. The attacker's objective at this stage is not to steal valid credentials but to present a token the server ought to reject — for example a token that is not properly authorized for the target context — and observe that the server proceeds rather than returning an authentication failure.

3. Payload / execution method. Per the NVD description, the immediate effect is unauthorized access through misuse of a token. At the class level, the attacker uses the improperly accepted token to authenticate requests to MarkLogic application and/or administrative interfaces. No specific request format, header name, or endpoint is asserted here because the source data does not name any.

4. Post-exploitation impact. With accepted-but-invalid authentication, the attacker can issue requests under the assumed identity. Consistent with the I:H CVSS impact, the attacker can act with integrity-level effect on server state — writing, modifying, or deleting documents and configuration within the access scope conferred by the incorrectly accepted token. From there, typical objectives include data manipulation, planting malicious content, escalating within the MarkLogic application context, and using the foothold for further movement within the enterprise. The score does not assert direct confidentiality or availability impact, so this report does not claim data exfiltration or denial of service as a scored outcome; those would be follow-on risks dependent on the privileges wrongly conferred.

Impact Assessment

Business impact centers on the integrity and trust of an enterprise data platform. MarkLogic Server is used to store and serve governed operational data — documents, JSON, XML, and semantic/graph content — frequently powering regulated, audit-relevant, and customer-facing applications. Successful exploitation of CVE-2026-85958 means authentication can be bypassed via a token the server should reject, allowing unauthorized actors to act as if authenticated and to modify data and state within the wrongly granted scope.

CVSS subscores:

• Base score 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
• Attack Vector Network (AV:N): exploitable remotely over the network.
• Attack Complexity Low (AC:L): no special conditions are described.
• Privileges Required None (PR:N): the attacker needs no prior authentication, consistent with a token-acceptance bypass.
• User Interaction None (UI:N): no victim action required.
• Scope Unchanged (S:U): impact is confined to the affected server's security authority.
• Confidentiality None (C:N), Integrity High (I:H), Availability None (A:N): scored impact is integrity-concentrated, reflecting unauthorized modification/action under a wrongly accepted token.

Blast radius: every network-reachable MarkLogic Server instance prior to 11.3.7 or 12.1.0 that accepts token-based authentication is in scope. On-premises enterprise clusters, cloud-hosted deployments, and managed/embedded MarkLogic instances across application tiers are all potentially affected. There is no evidence of CISA KEV listing or in-the-wild exploitation in the provided data, but the combination of remote reachability, no privileges required, no user interaction, and authentication bypass makes this a high-priority exposure for organizations with MarkLogic serving sensitive workloads.

Detection Guidance

Detection must focus on anomalous or rejected-but-accepted token authentication at MarkLogic application and administrative interfaces, and on integrity-changing actions occurring under identities associated with token use. Because no specific endpoint, header, or parameter is named in the source data, the rules below detect the vulnerability class generically and should be tuned to the environment's MarkLogic listener ports, hostnames, and authentication logging format.

Sigma Rule

title: Potential MarkLogic Token Authentication Bypass (CVE-2026-85958)
id: 9c1f4d2e-7a30-4b1c-9f5e-marklogic-bypass
status: experimental
description: Detects anomalous authentication success or rejected-token-accepted events on MarkLogic Server potentially related to CWE-287 token validation bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85958
author: valtersit.com threat intelligence
date: 2026/01/01
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-85958
logsource:
  category: application
  product: marklogic
detection:
  selection_product:
    - product: "MarkLogic"
    - app: "MarkLogic Server"
  selection_auth_anomaly:
    - message|contains:
        - "token"
        - "Token"
        - "authentication"
    - event_type|contains:
        - "auth"
        - "login"
        - "token"
  selection_outcome:
    outcome|contains:
      - "accepted"
      - "success"
      - "granted"
  selection_suspicious_source:
    src_ip|cidr:
      - "0.0.0.0/0"
  condition: selection_product and selection_auth_anomaly and selection_outcome
falsepositives:
  - Legitimate token-authenticated application traffic
  - Health checks and service accounts
level: medium

YARA Rule

rule CVE_2026_85958_MarkLogic_TokenAuthBypass_Log_Indicator
{
    meta:
        description = "Detects log/HTTP artifacts referencing MarkLogic token authentication events potentially tied to CVE-2026-85958; heuristic, class-level indicator only"
        author = "valtersit.com threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85958"
        cve = "CVE-2026-85958"
        cwe = "CWE-287"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ml1 = "MarkLogic" ascii wide nocase
        $ml2 = "marklogic" ascii nocase
        $tok1 = "token" ascii wide nocase
        $auth1 = "authentication" ascii wide nocase
        $un1 = "unauthorized access" ascii wide nocase
        $rej1 = "token should not be accepted" ascii wide nocase
        $cve = "CVE-2026-85958" ascii wide nocase

    condition:
        (uint16(0) == 0x4D5A or uint16(0) == 0x1F8B or true) and
        $cve or
        ($ml1 and ($tok1 or $auth1) and $un1) or
        ($ml2 and $rej1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85958 Possible MarkLogic Token Authentication Bypass Attempt"; flow:established,to_server; http.header; content:"Authorization"; nocase; http.header; content:"Bearer"; nocase; http.user_agent; content:"MarkLogic"; nocase; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,CVE-2026-85958; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85958; metadata:affected_product MarkLogic_Server; sid:202685958; rev:1;)

Note: The rule above targets token-bearing authentication requests to MarkLogic interfaces as a heuristic trigger. It does not assert a specific vulnerable endpoint because none is provided in the source data; tune http.uri and ports to match the deployment.

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where
      network.protocol == "http" and
      http.request.method in ("GET", "POST", "PUT", "DELETE") and
      (http.request.headers contains "Authorization" or
       http.request.headers contains "Bearer" or
       url.path contains "token") ]
  [ network where
      network.protocol == "http" and
      http.response.status_code == 200 and
      user_agent.original contains "MarkLogic" ]

Note: This EQL sequence flags a token-bearing request followed by a success response to a MarkLogic-identified client within 60 seconds. Adjust user_agent.original and field names to match ECS normalization in the target deployment.

Splunk SPL Query

index=marklogic OR index=web OR index=proxy
(sourcetype="marklogic:*" OR sourcetype="access_combined" OR sourcetype="stream:http")
(uri_path="*" AND (http_user_agent="*MarkLogic*" OR server="*MarkLogic*" OR product="MarkLogic"))
((authorization="*Bearer*" OR authorization="*token*" OR body="*token*" OR uri_query="*token*"))
(status=200 OR status=201 OR status=204)
| stats count min(_time) as first_seen max(_time) as last_seen
    values(status) as statuses
    by src_ip, uri_path, http_user_agent, server
| where count >= 1
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Note: Tune index/sourcetype/field names to the environment's MarkLogic and proxy log schema.

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85958,authentication_bypass,">
  <rule id="202685958" level="12">
    <decoded_as>json</decoded_as>
    <field name="product">MarkLogic</field>
    <field name="event_type">authentication</field>
    <match>token</match>
    <regex type="pcre2">(?i)(accepted|granted|bypass|invalid token accepted)</regex>
    <description>CVE-2026-85958: Possible MarkLogic Server token authentication bypass - token improperly accepted</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,marklogic,</group>
  </rule>

  <rule id="202685959" level="10">
    <decoded_as>json</decoded_as>
    <field name="product">MarkLogic</field>
    <match>token</match>
    <regex type="pcre2">(?i)(reject|denied|refused)</regex>
    <description>CVE-2026-85958: MarkLogic token authentication rejection - monitor for repeat attempts</description>
    <group>authentication_failure,marklogic,</group>
  </rule>
</group>

Note: These rules assume JSON log ingestion with fields product and event_type. Adjust the decoder and field names to the format produced by the MarkLogic deployment or its upstream log shipper.

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No patch evidence, vendor advisory, or fix artifact was confirmed by any tracked source. The NVD description names the fixed versions (12.1.0 and 11.3.7), but no independent patch source was provided. Treat the following as prioritized actions.

1. Immediate mitigations (before a confirmed patch can be validated):

• Restrict network exposure of MarkLogic Server HTTP/HTTPS administrative and application interfaces. Place them behind authenticated reverse proxies, allow-list corporate/VPN address ranges, and block public internet exposure wherever operationally feasible.
• Audit all token-issuing and token-consuming integrations. Where possible, enforce strict token validation at a trusted intermediary (API gateway, reverse proxy) that verifies signature, issuer, audience, and expiry before traffic reaches MarkLogic.
• Reduce token lifetimes and rotate signing keys. Revoke or reissue tokens that cannot be verified as properly bound to their intended audience and issuer.
• Enable and centralize authentication logging at high verbosity, and alert on accepted authentication using tokens that the server should reject (see Detection Guidance).
• Apply least privilege to all MarkLogic roles and service accounts so that any improperly accepted token confers the minimum feasible access.

2. Patch / upgrade steps:

• Upgrade MarkLogic Server 12.x deployments to 12.1.0 or later, and 11.x deployments to 11.3.7 or later, as named in the NVD description.
• Since patch confidence is 0/4, verify the fixed-version availability directly with Progress and validate the fix in a staging environment before production rollout.
• After upgrade, re-test token validation behavior with the deployment's own authentication test cases to confirm tokens that should be rejected are in fact rejected.
• Review logs for anomalous accepted-token authentication during the exposure window to identify any historical misuse.

3. Long-term hardening:

• Centralize authentication for all MarkLogic interfaces through a hardened identity provider / gateway that performs complete token validation (signature, issuer, audience, expiry, revocation).
• Adopt short-lived tokens, mutual TLS for administrative interfaces, and network segmentation isolating database platforms from user-facing tiers.
• Maintain an asset inventory of MarkLogic instances and versions, and track advisories from Progress for affected branches.
• Incorporate CWE-287 authentication bypass checks into secure code review and CI validation for any custom integrations that consume or mint tokens.
• Monitor FIRST EPSS and CISA KEV for updated exploitation signals; neither currently indicates active exploitation in the provided data.

References

• NVD — CVE-2026-85958: https://nvd.nist.gov/vuln/detail/CVE-2026-85958
• Progress MarkLogic Server product and security advisories: https://www.progress.com/marklogic
• MITRE CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (check for CVE-2026-85958 listing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data for CVE-2026-85958. No public PoC, Nuclei template, or exploit code is currently available.