CVE-2026-85966

Executive Summary

CVE-2026-85966 is an information disclosure vulnerability affecting Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7, where the product does not sufficiently restrict access to certain security-sensitive information. A remote, authenticated attacker holding only limited management permissions could retrieve this information and leverage it to reach protected resources that should be out of scope for their role. With a CVSS base score of 7.7 and a Scope:Changed rating, successful exploitation exposes data beyond the vulnerable component's own security authority, making it a serious concern for multi-tenant or role-segmented MarkLogic deployments.

Technical Analysis

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The NVD description states that affected MarkLogic Server versions "do not sufficiently restrict access to certain security-sensitive information." The defect lies in the authorization boundary governing security-sensitive information: the access-control logic does not adequately enforce restrictions for a principal that already possesses limited management permissions. In practical terms, an authenticated user with a narrowly scoped administrative role can obtain information that should have remained confined to higher-privileged roles.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N characterizes the issue precisely:

• Attack Vector: Network (AV:N) — the flaw is reachable over the network, consistent with MarkLogic's management and application interfaces.
• Attack Complexity: Low (AC:L) — no specialized conditions or race windows are described.
• Privileges Required: Low (PR:L) — the attacker must be an authenticated user, aligning with the "remote authenticated attacker with limited management permissions" language.
• User Interaction: None (UI:N) — no victim action is needed.
• Scope: Changed (S:C) — the disclosed information enables access to resources outside the vulnerable component's intended security scope, which is why the score is elevated despite Confidentiality-only impact.
• Confidentiality: High (C:H), Integrity: None (I:N), Availability: None (A:N).

Notably, no specific endpoint, API path, parameter, module, or function name is disclosed in the available description. The report therefore describes the attack strictly at the vulnerability-class level and does not infer implementation specifics. No public proof-of-concept, Nuclei template, or exploit code is known, and EPSS has not yet assigned a score. CISA KEV does not list this CVE.

Exploitation Scenarios

Because no public PoC exists and the CNA/NVD text is sparse, the following attack chain is inferred from the vulnerability class (improper access control exposing sensitive information) and is not derived from observed in-the-wild activity.

1. Reconnaissance / target identification: The attacker identifies an internet- or intranet-exposed MarkLogic Server instance running an affected 12.x (< 12.1.0) or 11.x (< 11.3.7) release. Exposed management interfaces, administrative consoles, or documented server interfaces are typical discovery surfaces; Shodan-style product fingerprinting for "Progress MarkLogic" can be used to enumerate candidate hosts.

2. Access establishment: The attacker authenticates with a legitimate but low-privilege management account — for example, an account provisioned for a limited operational role. PR:L in the CVSS vector confirms that only limited, authenticated access is required; no administrative escalation is needed to reach the vulnerable behavior.

3. Triggering the flaw: Using their limited management permissions, the attacker queries or accesses the security-sensitive information that the product fails to adequately restrict. The vulnerability is an authorization enforcement gap rather than an injection or memory-safety issue, so exploitation consists of requesting information the underlying access-control logic should have denied.

4. Post-exploitation impact: The obtained security-sensitive information allows the attacker to reach protected resources that should have remained inaccessible. Because the CVSS scope is Changed, the compromise extends beyond the vulnerable component into adjacent resources governed by the same trust relationship. The impact is confidentiality-focused (C:H, I:N, A:N): data exposure and unauthorized resource access rather than data destruction or service disruption.

No public exploit code, weaponized tooling, or observed threat-actor campaign is associated with this CVE at the time of writing. Organizations should treat the absence of a PoC as a temporary condition, since authorization-bypass classes are frequently reverse-engineered rapidly after patch release.

Impact Assessment

Successful exploitation results in unauthorized disclosure of security-sensitive information. The attacker must already hold authenticated, low-privilege management access, which narrows the initial attack surface but does not reduce the severity for organizations that grant broad internal access to operational or support staff, managed service providers, or integration accounts. The Scope:Changed rating indicates that the breach of confidentiality can propagate to resources outside the vulnerable component, effectively allowing lateral access into protected data and systems within the MarkLogic deployment.

Business impact includes: exposure of regulated or proprietary data stored or referenced by the platform; potential violation of data-protection obligations (for example GDPR, HIPAA, or PCI DSS) if the disclosed information includes personal, health, or cardholder data; and erosion of role-based access controls relied upon for multi-tenant segmentation. Because the vulnerability is unpatched per tracked sources and no workarounds are documented, the residual risk window is open until administrators upgrade to MarkLogic Server 12.1.0 or 11.3.7. Blast radius is highest in deployments where many users hold limited management roles and where sensitive information is co-located with lower-trust workloads.

Detection Guidance

Sigma Rule

title: MarkLogic Sensitive Information Access by Low-Privilege Management Account
id: 9f1c2a44-8e5b-4d3a-b7c1-marklogic-cve202685966
status: experimental
description: Detects access attempts to security-sensitive MarkLogic Server information by accounts with limited management permissions, consistent with CVE-2026-85966.
logsource:
  product: marklogic
  service: audit
detection:
  selection_privilege:
    UserPrivilege|contains:
      - 'manage-user'
      - 'manage-admin'
      - 'limited'
  selection_sensitive:
    RequestPath|contains:
      - '/manage'
      - '/admin'
      - '/security'
  condition: selection_privilege and selection_sensitive
falsepositives:
  - Legitimate administrative troubleshooting by authorized staff
level: high
tags:
  - attack.t1190
  - cve.2026.85966

YARA Rule

rule CVE_2026_85966_MarkLogic_InfoDisclosure
{
    meta:
        description = "Detects references to MarkLogic security-sensitive information access consistent with CVE-2026-85966"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85966"
        cve = "CVE-2026-85966"
    strings:
        $ml = "MarkLogic" ascii wide nocase
        $conf = "MarkLogic Server" ascii wide nocase
        $v12 = "12.1.0" ascii wide
        $v11 = "11.3.7" ascii wide
    condition:
        $ml and $conf and any of ($v*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85966 Progress MarkLogic Sensitive Information Access Attempt"; flow:established,to_server; http.user_agent; content:"MarkLogic"; http.uri; content:"/manage"; http.uri; content:"/security"; classtype:attempted-recon; sid:2026859660; rev:1; metadata:cve CVE-2026-85966;)

Elastic Detection

sequence by user.name with maxspan=5m
  [authentication where event.outcome == "success" and user.roles : ("manage-user" or "manage-admin")]
  [http where url.path : ("*manage*" or "*security*" or "*admin*") and http.response.status_code == 200]

Splunk SPL Query

index=marklogic sourcetype="marklogic:audit" (uri="*manage*" OR uri="*security*" OR uri="*admin*") user_privilege IN ("manage-user","manage-admin","limited") status=200
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip user uri
| where count > 5
| table first_seen last_seen src_ip user uri count

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85966,">
  <rule id="100966" level="12">
    <decoded_as>json</decoded_as>
    <field name="product">MarkLogic</field>
    <field name="uri">\.(manage|security|admin)</field>
    <field name="status">200</field>
    <description>CVE-2026-85966: Possible unauthorized access to security-sensitive MarkLogic information by limited-privilege account</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix version, workaround, or patch artifact has been confirmed; the version thresholds cited by the CNA (12.1.0 and 11.3.7) should be validated against the vendor advisory before relying on them.

1. Immediate mitigations:

• Restrict network reachability of MarkLogic management and administrative interfaces to trusted management networks only; do not expose them to the internet or broad internal segments.
• Apply least privilege aggressively: audit accounts with limited management permissions and remove any that are not strictly required.
• Enable and centralize audit logging for management and security-related requests so that anomalous information access can be detected (see Detection Guidance).

2. Patch / upgrade steps:

• Track the Progress MarkLogic advisory channel for an official fix; upgrade to MarkLogic Server 12.1.0 or 11.3.7 (or later) once the vendor confirms the fix.
• Before upgrading, inventory all 11.x and 12.x instances to determine which are in the affected ranges.

3. Long-term hardening:

• Enforce strong authentication and MFA on all management accounts, and rotate credentials for any accounts that may have observed or accessed sensitive information.
• Segment sensitive data stores from lower-trust workloads to limit cross-scope impact if an authorization gap is exploited again.
• Monitor EPSS and CISA KEV for updates, as authorization-bypass issues often see weaponization after public disclosure.

References

• NVD — CVE-2026-85966: https://nvd.nist.gov/vuln/detail/CVE-2026-85966
• Progress MarkLogic Server product and security advisories: https://www.progress.com/marklogic
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• MITRE CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• FIRST EPSS (not yet scored at time of writing): https://www.first.org/epss/