#NØØT_Security_Alerts 🚨 #ALERT — CRITICAL MARKLOGIC FLAW ALLOWS PERSISTENT ADMINISTRATOR ACCOUNT CREATION October 12, 2026 DISCLOSED BY: Progress Software PRODUCT: MarkLogic Server CVE: CVE-2026-85947 SEVERITY: CRITICAL — CVSS 9.9 AFFECTED VERSIONS: 11.0.0 through versions before 11.3.7. 12.0.0 through versions before 12.1.0. IMPACT: An authorization flaw in forest-management operations allows attackers with existing forest-management privileges to create persistent unauthorized administrator accounts. Successful exploitation could provide complete administrative control over the database server. EXPOSURE: Requires authenticated access with forest-management privileges and network reachability to affected management functionality. This is NOT an unauthenticated vulnerability. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL PRIVILEGE ESCALATION. No verified public working PoC or confirmed malicious exploitation in the wild. Forensic triage: Audit administrator-account creation, forest-management operations, privilege assignments and unexpected management API activity. Investigate newly created privileged accounts and unauthorized database configuration changes. No CVE-specific malicious IOCs have been published. URGENT ACTION: Upgrade affected MarkLogic 11.x installations to 11.3.7 or later and 12.x installations to 12.1.0 or later. Restrict management interfaces, review forest-management permissions and investigate unexpected privileged accounts. SOURCE: https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026 OFFICIAL CVE: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85947.json CONFIDENCE: HIGH — Progress-authored CVE record confirms the vulnerability, affected versions, prerequisites and critical impact. Active exploitation remains unverified. #CyberSecurity #ThreatIntel #MarkLogic #PrivilegeEscalation #DatabaseSecurity
