CVE-2026-85963

Executive Summary

CVE-2026-85963 is a critical weakness in deprecated OpsDirector functionality shipped within Progress MarkLogic Server 12.x (before 12.1.0) and 11.x (before 11.3.7). The flaw permits an unauthenticated remote attacker to issue unauthorized requests to internal services or forge trusted requests, leading to unauthorized access to protected information. Any internet- or network-exposed MarkLogic instance retaining the deprecated OpsDirector component is in scope, and because the attack requires no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), it presents a high-value, low-friction target.

Technical Analysis

OpsDirector is a legacy MarkLogic management/monitoring component that historically provided operational visibility and administration of MarkLogic clusters. According to the NVD description, the deprecated functionality "include[s] weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests." This describes a trust-boundary failure: a component that is expected to communicate with internal services (or to present requests as originating from a trusted source) does not adequately validate the origin, authenticity, or authorization of inbound requests. As a result, an attacker who can reach the OpsDirector endpoint can cause the server to relay or accept requests that the attacker is not authorized to make, or can impersonate a trusted caller.

The vulnerability is classified under CWE-321 ("Use of Hard-coded Cryptographic Key"). This classification indicates that the trust established between OpsDirector and internal services — or between peers — relies on a static, embedded cryptographic secret. When the same key is shared across deployments or shipped within the product, an attacker who obtains or guesses that key can sign or construct requests that downstream services accept as legitimate ("forge trusted requests"). The absence of per-installation key rotation defeats the purpose of cryptographic authentication, allowing unauthenticated parties to bypass authentication and authorization controls.

Two distinct attack surfaces are implied:

1. Unauthorized requests to internal services (SSRF-like) — The attacker leverages the trust the MarkLogic host has toward internal endpoints to make the server issue requests on the attacker's behalf.
2. Forged trusted requests (authentication/authorization bypass) — The attacker constructs requests that appear to originate from a trusted internal component or peer, causing protected information to be disclosed because the request is treated as legitimate.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms the network attack vector, low complexity, no privileges or user interaction required, unchanged scope, and a high confidentiality impact — the leak of protected information. Impact to integrity and availability is rated None, consistent with a read/leak-oriented exposure rather than data destruction or service disruption.

The exact request format, parameter names, endpoints, cryptographic key material, and internal service list are not disclosed in the available NVD description. No vendor advisory text, PoC, Nuclei template, or exploit code is available. This report therefore describes the vulnerability class (hard-coded cryptographic key enabling request forgery and unauthorized internal requests) without inventing implementation specifics.

Exploitation Scenarios

No public proof-of-concept exists. The following chain is inferred strictly from the vulnerability class and the NVD description; no specific endpoint, parameter, function, or key is fabricated.

1. Reconnaissance / target identification. The attacker identifies an exposed MarkLogic Server instance running a vulnerable 12.x (< 12.1.0) or 11.x (< 11.3.7) release. Because OpsDirector is a management/operational component, reachable instances may be discoverable via service fingerprinting of MarkLogic administrative/monitoring interfaces. The attacker confirms the server version and presence of the deprecated OpsDirector functionality.

2. Triggering the flaw. Because the trust mechanism relies on a hard-coded cryptographic key (CWE-321), the attacker crafts requests that carry a signature or credential derived from the embedded key. The deprecated component accepts these requests without verifying the true origin, so the attacker does not need valid user credentials or prior access.

3. Execution at the vulnerability-class level. Using the forged/unauthorized request, the attacker (a) instructs the MarkLogic host to issue requests to internal services it trusts ("unauthorized requests to internal services"), or (b) presents requests as if from a trusted source ("forge trusted requests"). Both paths rely on the defective trust relationship rather than on exploiting memory corruption or code execution.

4. Post-exploitation impact. Successful requests yield unauthorized access to protected information — data the attacker is not entitled to read. Because integrity and availability impacts are rated None, the demonstrated objective is information disclosure. Depending on what internal services the trusted component can reach, disclosed data could include configuration, metadata, or other protected records accessible to the trusted channel.

Caveat: no public PoC or exploitation reports exist; the sequence is a mechanism-level inference from the vulnerability class and the official description.

Impact Assessment

• Confidentiality: High (C:H). The primary consequence is unauthorized access to protected information, matching the CNA's stated outcome.
• Integrity: None / Availability: None. The CVSS vector rates these as None; the flaw is not described as enabling data modification or denial of service.
• Scope: Unchanged (S:U). Impact is confined to the vulnerable authorization/trust boundary within the affected component.
• Base score: 7.5 (High). AV:N/AC:L/PR:N/UI:N means the vulnerability is exploitable by any network-reachable attacker with no credentials and no user interaction, which raises the practical risk beyond the raw score in environments where OpsDirector is exposed.
• Affected systems. Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 that retain the deprecated OpsDirector functionality. MarkLogic is frequently deployed as a data platform holding regulated, sensitive, or business-critical content, so a confidentiality breach of the platform can expose enterprise data at scale.
• Blast radius. Because the defect allows the forging of "trusted requests" and access to "internal services," the trust boundary that is crossed may extend beyond a single host to the internal services the deprecated component is authorized to contact. Internet-facing or broadly reachable instances represent the largest exposure.

Detection Guidance

Sigma Rule

title: Progress MarkLogic OpsDirector Unauthenticated Request Forgery Attempt (CVE-2026-85963)
id: 7c2f9a10-4b8e-4d2a-9f3e-0a1b2c3d4e5f
status: experimental
description: Detects anomalous or unauthenticated access to deprecated OpsDirector functionality on Progress MarkLogic Server that may indicate request forgery / unauthorized internal requests (CVE-2026-85963).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85963
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: marklogic
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/OpsDirector'
      - '/opsdirector'
  selection_status:
    sc-status:
      - 200
      - 401
      - 403
  filter_authorized:
    cs-username|exists: true
  condition: selection_path and selection_status and not filter_authorized
falsepositives:
  - Legitimate administrative access to monitoring interfaces
  - Health-check probes from load balancers
level: high
tags:
  - attack.t1190
  - cve.2026-85963

YARA Rule

rule CVE_2026_85963_MarkLogic_OpsDirector_Hardcoded_Key
{
    meta:
        author      = "valtersit.com"
        description = "Detects deprecated MarkLogic OpsDirector components associated with CVE-2026-85963 (hard-coded cryptographic key enabling request forgery)."
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-85963"
        date        = "2026-01-01"
        cve         = "CVE-2026-85963"

    strings:
        $opsdirector1 = "OpsDirector" ascii wide nocase
        $opsdirector2 = "opsdirector" ascii wide nocase
        $marklogic    = "MarkLogic" ascii wide nocase

    condition:
        ($opsdirector1 or $opsdirector2) and $marklogic
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85963 Progress MarkLogic OpsDirector Unauthenticated Request Forgery Attempt"; flow:established,to_server; http.uri; content:"OpsDirector"; nocase; http.method; content:"GET"; http.header; content:"User-Agent"; pcre:"/MarkLogic/i"; classtype:attempted-recon; reference:cve,2026-85963; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85963; sid:202685963; rev:1;)

Elastic Detection

sequence by host.name with maxspan=30s
  [ network where process.name != null and network.transport == "tcp" and
      (url.path : "*OpsDirector*" or url.path : "*opsdirector*") and
      http.request.method : "GET" ]
  [ network where user.name == null and
      (url.path : "*OpsDirector*" or url.path : "*opsdirector*") ]

Splunk SPL Query

index=web OR index=marklogic
| eval uri=coalesce(cs_uri_stem, uri, url_path)
| eval src=coalesce(src_ip, c_ip, clientip)
| where match(lower(uri), "opsdirector")
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as statuses values(useragent) as user_agents by src uri
| where statuses=200 OR statuses=401 OR statuses=403
| sort - count
| table src uri count first_seen last_seen statuses user_agents

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85963,">
  <rule id="100963" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">OpsDirector</field>
    <description>CVE-2026-85963: Possible unauthenticated OpsDirector request forgery attempt against Progress MarkLogic Server</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,pci_dss_10.2.4,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is confirmed.

1. Immediate mitigations

   • Remove or disable the deprecated OpsDirector functionality wherever it is not strictly required. Deprecated components that are no longer needed should not remain reachable.
   • Restrict network access to MarkLogic management, monitoring, and OpsDirector-related interfaces using firewall rules, security groups, and network segmentation. Do not expose these interfaces to untrusted networks or the internet.
   • Enforce authentication at the network edge (reverse proxy, API gateway) so that requests to operational endpoints cannot reach the backend unauthenticated.
   • Monitor access logs for unauthenticated or anomalous requests to OpsDirector paths and for unexpected server-initiated requests to internal services.

2. Patch / upgrade steps

   • Progress identifies the remediated releases as MarkLogic Server 12.1.0 (for the 12.x line) and 11.3.7 (for the 11.x line). Plan an upgrade to a supported, fixed release.
   • Because no patch artifact is confirmed by tracked sources (patch confidence 0/4), validate the fixed version against the vendor before deploying and confirm in the vendor's release notes that the OpsDirector weakness is addressed.
   • Inventory all MarkLogic deployments to identify instances running versions before 12.1.0 and 11.3.7.

3. Long-term hardening

   • Eliminate reliance on hard-coded cryptographic keys (CWE-321): ensure per-installation, rotatable secrets and unique keys for any inter-service trust mechanism.
   • Apply zero-trust principles to internal service-to-service communication so that a single compromised or trusting component cannot forge requests to peers.
   • Maintain an asset and version inventory for data platforms and retire deprecated functionality promptly.

References

• NVD — CVE-2026-85963: https://nvd.nist.gov/vuln/detail/CVE-2026-85963
• Progress MarkLogic Server product documentation and security advisories: https://www.progress.com/marklogic
• CWE-321 — Use of Hard-coded Cryptographic Key: https://cwe.mitre.org/data/definitions/321.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or known exploit-in-the-wild activity has been identified for CVE-2026-85963 at the time of writing. CISA KEV status: not listed.