CVE-2026-85961

Executive Summary

CVE-2026-85961 is an information-disclosure vulnerability in Progress MarkLogic Server (12.x before 12.1.0 and 11.x before 11.3.7) in which security-sensitive authentication information may be written to diagnostic logs under certain configurations on Azure deployments. An attacker who gains access to those logs can harvest the exposed authentication material and use it to obtain unauthorized access to protected cloud resources. With a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the flaw is remotely reachable and requires no privileges or user interaction, but its confidentiality impact is high and there is no integrity or availability effect.

Technical Analysis

The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File). MarkLogic Server, when deployed on Microsoft Azure, may capture security-sensitive authentication information within its diagnostic logging output under certain configurations. The exact log format, logging verbosity settings, and the precise authentication fields that are recorded are not specified in the available description; accordingly, this analysis stays at the vulnerability-class level and does not assert specific function names, log files, or configuration keys.

The core weakness is a logging hygiene failure: data that should never persist in plaintext (for example, authentication material used to reach protected cloud resources) is instead written into diagnostic logs alongside operational messages. Logs are frequently stored with weaker access controls than the credentials they contain, may be shipped to centralized collectors, backups, or third-party monitoring platforms, and may be readable by a broader set of operators than intended. Because the CVSS vector indicates network reachability (AV:N) with no required privileges (PR:N) and no user interaction (UI:N), the practical attack model is not exploitation of the server process itself but acquisition of the log artifacts, followed by reuse of the exposed authentication material.

The confidentiality-only CVSS impact (C:H, I:N, A:N) is consistent with a leak of secrets: an attacker does not corrupt data or cause a denial of service, but gains a high-value credential that can unlock "protected cloud resources." The phrase "under certain configurations" implies that not every deployment is affected — the condition is configuration-dependent, which affects both exploitability and triage. No CWE other than CWE-532 is assigned, and no PoC, exploit code, or Nuclei template is publicly available. Patch confidence is 0/4 with no vendor fix confirmed from tracked sources, so defenders should treat the issue as unpatched and prioritize compensating controls.

Exploitation Scenarios

The attack chain for this vulnerability is inferred from the vulnerability class (sensitive information in logs) because no public PoC exists. No specific endpoints, parameters, or log paths are asserted, as none are provided in the source data.

1. Reconnaissance / target identification. The attacker identifies MarkLogic Server deployments running on Azure, particularly instances in the affected version ranges (12.x before 12.1.0, 11.x before 11.3.7). Reconnaissance focuses on locating diagnostic log stores — local log volumes, log aggregation platforms, object storage buckets, or backup archives — rather than on probing the application directly.

2. Trigger / exposure condition. The flaw is not "triggered" by an exploit payload; the sensitive authentication information is recorded passively when the server writes diagnostic logs under the vulnerable configuration. The attacker's task is therefore to obtain read access to those logs, whether through over-permissive log storage, leaked or misconfigured log exports, access to a shared logging/monitoring platform, or possession of a log bundle.

3. Extraction at the vulnerability-class level. Once logs are obtained, the attacker searches them for authentication information — credentials, tokens, or other security-sensitive values — that the vulnerable configuration recorded in cleartext.

4. Post-exploitation impact. With valid authentication material recovered from the logs, the attacker attempts to authenticate to the referenced protected cloud resources. Successful reuse results in unauthorized access to those resources, with the scope of impact bounded by the permissions associated with the exposed credentials. There is no evidence of in-the-wild exploitation, no CISA KEV listing, and no public exploit code; the chain above is a reasoned model, not an observed campaign.

Impact Assessment

Business impact centers on credential compromise and subsequent unauthorized access to cloud resources, which can cascade into data exposure, lateral movement within the cloud environment, and abuse of the trust relationships attached to the leaked identity. The CVSS base score is 7.5 (High). Subscore interpretation:

• AV:N (Network): the exposure is reachable over a network, consistent with cloud-hosted deployments and remote log access.
• AC:L (Low): no special conditions beyond the vulnerable configuration are required.
• PR:N (None): the attacker needs no prior account or privilege to reach the affected attack surface.
• UI:N (None): no victim interaction is required.
• S:U (Unchanged): the impact remains within the security scope of the affected component.
• C:H (High): the primary effect is loss of confidentiality of sensitive authentication information.
• I:N / A:N: no integrity or availability impact is scored.

Blast radius depends on the privileges of the leaked authentication material and on how widely the diagnostic logs are distributed (local files, SIEM, log shippers, backups). Any organization running affected MarkLogic versions on Azure with diagnostic logging that captures authentication data is in scope. Because the issue is UNPATCHED with no vendor fix and no known workaround from tracked sources, exposure persists until configuration changes or an eventual vendor release are applied.

Detection Guidance

The rules below target the vulnerability class (sensitive data in logs and reuse of leaked credentials). Match patterns such as "password", "token", or "secret" inside diagnostic log content should be tuned to the actual field names present in your environment, since none are specified in the source data.

Sigma Rule

title: Potential MarkLogic Diagnostic Log Credential Exposure (CVE-2026-85961)
id: 6b6f2c1e-8596-4612-9a52-marklogiclog01
status: experimental
description: Detects access to or exfiltration of MarkLogic diagnostic logs that may contain security-sensitive authentication information on Azure deployments.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85961
author: valtersit.com
date: 2026/01/01
logsource:
  category: file_access
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\MarkLogic\'
      - 'MarkLogic/Logs'
      - 'marklogic.log'
  selection_keywords:
    FileName|contains:
      - 'ErrorLog'
      - 'Diagnostic'
      - 'AuditLog'
  condition: selection_path and selection_keywords
falsepositives:
  - Legitimate administrative log collection
  - Backup agents reading log directories
level: medium
tags:
  - attack.t1552
  - cve.2026-85961

YARA Rule

rule CVE_2026_85961_MarkLogic_Log_Credential_Leak
{
    meta:
        description = "Detects MarkLogic diagnostic log content containing security-sensitive authentication information (CVE-2026-85961)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85961"
        cve = "CVE-2026-85961"

    strings:
        $ml = "MarkLogic" ascii nocase
        $auth1 = "password" ascii nocase
        $auth2 = "passwd" ascii nocase
        $auth3 = "secret" ascii nocase
        $auth4 = "token" ascii nocase
        $auth5 = "authorization" ascii nocase
        $log = "diagnostic" ascii nocase

    condition:
        $ml and $log and any of ($auth*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-85961 MarkLogic Sensitive Authentication Data in Diagnostic Log - possible exfiltration"; flow:established,to_server; content:"MarkLogic"; http_header; nocase; content:"diagnostic"; http_uri; nocase; pcre:"/(password|passwd|secret|token|authorization)/i"; classtype:attempted-recon; reference:cve,2026-85961; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85961; sid:202685961; rev:1;)

Elastic Detection

file where file.name : ("*marklogic*.log" or "*MarkLogic*ErrorLog*" or "*Diagnostic*") and
  file.Ext.extension : ("log" or "txt" or "gz" or "zip") and
  process.name : ("curl" or "wget" or "tar" or "scp" or "aws" or "az" or "rclone" or "python*") and
  event.category : "file"

Splunk SPL Query

index=marklogic OR index=cloud_logs (sourcetype=marklogic:* OR source="*marklogic*.log" OR source="*Diagnostic*")
| search ("password" OR "passwd" OR "secret" OR "token" OR "authorization")
| stats count min(_time) as first_seen max(_time) as last_seen values(source) as sources by host user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85961,">
  <rule id="100961" level="10">
    <if_sid>100960</if_sid>
    <decoded_as>marklogic</decoded_as>
    <match>password|passwd|secret|token|authorization</match>
    <description>CVE-2026-85961: Possible security-sensitive authentication data recorded in MarkLogic diagnostic logs.</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>cve_2026_85961,credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is currently confirmed from tracked sources.

1. Immediate mitigations

• Reduce diagnostic log verbosity on all MarkLogic deployments hosted on Azure until it can be confirmed that authentication information is no longer captured; restrict sensitive logging to the minimum required for operations.
• Treat all existing diagnostic logs as potentially containing secrets. Purge, rotate, and re-permission log stores; scan log aggregation platforms and backups for credential-like content.
• Harden access to log stores: apply least privilege to local log directories, object storage, SIEM, and log-shipping pipelines. Ensure logs are not world-readable or exposed through unauthenticated interfaces.
• Rotate any authentication material that may have been written to logs (tokens, credentials, or keys associated with protected cloud resources) as a precautionary measure.

2. Patch/upgrade steps

• Upgrades for 12.x (before 12.1.0) and 11.x (before 11.3.7) are referenced in the CVE description, but no patch evidence has been confirmed from tracked sources. Monitor the Progress MarkLogic security advisory channel and upgrade to the corrected releases as soon as the vendor publishes them.
• Re-verify logging configuration after any upgrade to confirm the credential-leak behavior is resolved.

3. Long-term hardening

• Enforce a logging standard that prohibits capturing secrets, tokens, and credentials; add pre-commit and pipeline linting for log statements.
• Adopt secrets management with short-lived, scoped credentials so any leaked value is quickly useless; avoid long-lived credentials tied to protected cloud resources.
• Centralize cloud-resource access through identity providers with rotation and least privilege, and continuously monitor for anomalous use of log-derived credentials.

References

• NVD — CVE-2026-85961: https://nvd.nist.gov/vuln/detail/CVE-2026-85961
• CWE-532 — Insertion of Sensitive Information into Log File: https://cwe.mitre.org/data/definitions/532.html
• Progress MarkLogic product security advisories: https://www.progress.com/security
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85961 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-85961 at the time of writing.