CVE-2026-85959

Executive Summary

CVE-2026-85959 affects Progress MarkLogic Server, a multi-model NoSQL database platform. Versions 12.x before 12.1.0 and 11.x before 11.3.7 fail to consistently record successful authentication events in audit logs. The impact is an integrity failure in the audit trail: security teams lose reliable visibility into successful logins, weakening detection and forensic investigation of unauthorized access or credential misuse.

Technical Analysis

The vulnerability is classified as CWE-778 (Insufficient Logging). The NVD description states that affected releases "do not consistently record successful authentication events in audit logs." This is not a memory-safety flaw, injection flaw, or authentication bypass — the authentication control itself may still function as designed. The defect lies in the logging subsystem's completeness: successful authentication events are logged inconsistently, meaning some proportion of legitimate or attacker-controlled successful logins leave no durable audit record.

The attack surface is the same as any authentication interface exposed by MarkLogic Server. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N reflects a network-reachable, low-complexity issue requiring no privileges and no user interaction, with a High integrity impact and no confidentiality or availability impact. This aligns with the nature of the flaw: exploitability is trivial because no exploitation is required to trigger the defect — the logging failure occurs during normal authentication operations, including those conducted by an adversary.

From a code-level perspective, insufficient technical detail is available in the provided data to identify the specific logging code path, function, or configuration responsible for the inconsistency. What can be stated at the vulnerability-class level is that the audit subsystem fails to emit an event for a subset of successful authentications. This may arise from conditional logging branches, buffering or write failures, or mismatches between authentication success in one component and audit emission in another. No specific function names, class names, or file paths are provided in the NVD description or CNA title, and none are asserted here.

The critical operational consequence is a partial audit blind spot. Because successful events are the baseline against which failed attempts, session activity, and administrative actions are correlated, inconsistent success logging degrades downstream correlation and alerting even when other log categories remain intact.

Exploitation Scenarios

Because this is a logging integrity defect rather than an exploitable code-execution or injection flaw, "exploitation" means leveraging the audit gap rather than triggering memory corruption or injecting commands. The chain is as follows.

1. Reconnaissance / target identification. An adversary identifies an internet- or intranet-exposed MarkLogic Server instance and determines it falls within an affected release range. No public PoC is available; the attack chain is inferred from the vulnerability class.

2. Establishing access. The adversary authenticates using valid credentials obtained through phishing, credential stuffing, password reuse, or prior compromise. Critically, the adversary does not need to defeat authentication — the flaw concerns the recording of successful authentications.

3. Exploiting the specific weakness (CWE-778). Because successful authentication events are not consistently written to audit logs, a subset of the adversary's logins generate no corresponding audit record. The adversary can proceed with authenticated activity while the security team's primary evidence source for "who logged in, and when" is incomplete. No specific request payload or parameter manipulation is required to benefit from the gap; the absence of a log entry is the exploited condition.

4. Post-exploitation impact. With degraded login telemetry, the adversary's authenticated sessions are harder to reconstruct. Investigators cannot reliably establish a timeline of access, cannot confirm which accounts were used, and cannot distinguish legitimate logins from adversarial ones during the affected window. This directly impairs incident response scoping and containment, and may allow persistent, authenticated access to remain undetected for extended periods.

No public proof-of-concept, exploit code, or Nuclei template is associated with this CVE.

Impact Assessment

The CVSS base score is 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The integrity subscore (I:H) reflects that the audit record — a data set expected to be complete and trustworthy — is corrupted by omission. Confidentiality (C:N) and availability (A:N) are unaffected at the base metric level, meaning the platform itself is neither directly exposing data nor taken offline by the flaw; the damage is to the evidentiary value of logs.

Business impact centers on detection and accountability rather than direct data loss. Affected organizations include any enterprise running MarkLogic Server 12.x before 12.1.0 or 11.x before 11.3.7, particularly those in regulated sectors where complete authentication audit trails are a compliance requirement (for example, financial services, healthcare, and government). The blast radius spans every authentication attempt processed by an affected instance, not a single targeted request. Secondary impact includes failed audits, unverifiable access-attribution during forensic investigations, and reduced confidence in SIEM correlation logic that assumes success events are reliably present. Because no CISA KEV listing exists and no exploit code is public, current exploitation likelihood is driven by whether an adversary is already operating against the environment — the flaw amplifies the impact of any credential-based intrusion rather than enabling a new intrusion on its own.

Detection Guidance

Sigma Rule

title: MarkLogic Insufficient Successful Authentication Logging - Log Volume Anomaly
id: 4f1c9a2e-7b3d-4e88-9c21-0a6d5f8b1c47
status: experimental
description: Detects anomalous absence or reduction of successful authentication audit events from Progress MarkLogic Server, consistent with CVE-2026-85959 insufficient logging.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85959
author: Threat Intelligence
logsource:
  product: marklogic
  service: audit
detection:
  selection:
    event_type: 'authentication'
    outcome: 'success'
  timeframe: 1h
  condition: selection | count() < 1
fields:
  - user
  - src_ip
  - event_type
  - outcome
falsepositives:
  - Legitimate periods of no user activity
  - Low-traffic maintenance windows
level: medium

YARA Rule

rule CVE_2026_85959_MarkLogic_Auth_Logging
{
    meta:
        description = "Detects references to MarkLogic audit configuration indicating authentication success logging behavior"
        cve = "CVE-2026-85959"
        cwe = "CWE-778"
        author = "Threat Intelligence"
        date = "2026-01-01"

    strings:
        $a = "audit" nocase
        $b = "authentication" nocase
        $c = "successful" nocase
        $d = "marklogic" nocase

    condition:
        (uint16(0) == 0x504B or uint32(0) == 0x04034b50 or filesize < 10MB) and
        all of ($a, $d) and any of ($b, $c)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET [8000,8001,8002] (msg:"CVE-2026-85959 Progress MarkLogic authentication activity on management interface"; flow:established,to_server; content:"POST"; http_method; content:"/"; http_uri; classtype:policy-violation; sid:90085959; rev:1; metadata:cve CVE-2026-85959, cwe CWE-778;)

Elastic Detection

sequence by user.name, source.ip with maxspan=1h
  [authentication where event.outcome == "success" and event.module == "marklogic"]
missing
  [authentication where event.outcome == "success" and event.module == "marklogic"]

Splunk SPL Query

index=marklogic sourcetype=marklogic:audit event_type=authentication
| stats count(eval(outcome="success")) as success_count, count(eval(outcome="failure")) as failure_count by user, src_ip
| eval success_ratio = if((success_count + failure_count) > 0, success_count / (success_count + failure_count), 0)
| where failure_count > 0 AND success_count == 0
| table user, src_ip, success_count, failure_count, success_ratio
| sort - failure_count

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85959,">
  <rule id="100859" level="8">
    <decoded_as>json</decoded_as>
    <field name="event_type">authentication</field>
    <field name="outcome">failure</field>
    <description>CVE-2026-85959: MarkLogic authentication failure observed with no corresponding successful authentication audit event - possible insufficient logging.</description>
    <mitre>
      <id>T1562.006</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Assume the audit trail for successful authentications is incomplete on affected instances. Do not rely solely on MarkLogic audit logs for access attribution. Correlate with independent sources: network flow records, reverse proxy or load balancer access logs, VPN/SSO authentication logs, and endpoint telemetry. Restrict network exposure of MarkLogic management and application ports to trusted networks, and enforce strong, unique credentials plus multi-factor authentication at the perimeter to reduce the value of the missing success-log signal.

2. Patch/upgrade steps. The NVD description identifies affected ranges as 12.x before 12.1.0 and 11.x before 11.3.7. Plan an upgrade to MarkLogic Server 12.1.0 or later (12.x line) or 11.3.7 or later (11.x line). Because no vendor advisory, patch reference, or source evidence is available in tracked feeds, validate the exact fixed build against Progress's official release notes and support channels before scheduling the upgrade, and test in a non-production environment first.

3. Long-term hardening. Implement defense-in-depth logging so that no single audit source is a bottleneck: forward authentication events from multiple tiers into the SIEM, enable integrity controls (write-once or remote log shipping) so audit records cannot be silently omitted or altered, and build detections (see above) that alert on the absence of expected success events, not just their presence. Review audit configuration after every upgrade, and include authentication-log completeness in routine control testing and compliance audits.

References

• NVD — CVE-2026-85959: https://nvd.nist.gov/vuln/detail/CVE-2026-85959
• CWE-778: Insufficient Logging — https://cwe.mitre.org/data/definitions/778.html
• Progress MarkLogic Server product and release documentation — https://www.progress.com/marklogic
• MITRE ATT&CK T1562.006 — Impair Defenses: Indicator Blocking — https://attack.mitre.org/techniques/T1562/006/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85959 not listed) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at the time of writing.