#NØØT_Security_Alerts 🚨 #ALERT — CRITICAL MARKLOGIC FLAW ALLOWS UNAUTHORIZED CROSS-DATABASE BACKUP AND RESTORE OPERATIONS October 12, 2026 DISCLOSED BY: Progress Software Corporation PRODUCT: MarkLogic Server CVE: CVE-2026-85956 SEVERITY: CRITICAL — CVSS 9.6 AFFECTED VERSIONS: MarkLogic Server 11.0.0–11.3.6. MarkLogic Server 12.0.0 through versions before 12.1.0. IMPACT: Improper privilege management allows attackers with delegated database-administrator privileges to perform backup or restore operations on forests outside their authorized database scope. Successful exploitation could expose protected information or permit unauthorized modification of security-critical database content. EXPOSURE: Requires authenticated access with delegated database-administrator privileges and network access to affected functionality. This is NOT an unauthenticated vulnerability. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL AUTHORIZATION BYPASS. No verified public working PoC or confirmed malicious in-the-wild exploitation. Forensic triage: Review backup and restore audit records, forest ownership, administrative permissions and unexpected cross-database operations. Investigate unauthorized changes to protected database content. No confirmed CVE-specific IOCs published. URGENT ACTION: Upgrade MarkLogic 11.x to 11.3.7 or later and MarkLogic 12.x to 12.1.0 or later. Restrict management interfaces and audit delegated administrator privileges. Investigate unauthorized backup or restore operations before trusting affected databases. SOURCE: https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026 OFFICIAL CVE: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85956.json CONFIDENCE: HIGH — Progress-authored CVE record confirms the vulnerability, affected releases, privileges required and potential impact. Active exploitation remains unverified. #CyberSecurity #ThreatIntel #MarkLogic #DatabaseSecurity #PrivilegeEscalation