{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-85956","assignerOrgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","state":"PUBLISHED","assignerShortName":"ProgressSoftware","dateReserved":"2026-09-04T18:42:47.236Z","datePublished":"2026-10-12T16:00:29.400Z","dateUpdated":"2026-10-12T16:00:29.400Z"},"containers":{"cna":{"providerMetadata":{"orgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","shortName":"ProgressSoftware","dateUpdated":"2026-10-12T16:00:29.400Z"},"title":"Improper privilege management in Progress MarkLogic Server backup and restore operations","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-269","description":"CWE-269: Improper Privilege Management","type":"CWE"}]}],"affected":[{"vendor":"Progress Software Corporation","product":"MarkLogic Server","versions":[{"status":"affected","version":"11.0.0","lessThan":"11.3.7","versionType":"custom"},{"status":"affected","version":"12.0.0","lessThan":"12.1.0","versionType":"custom"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.</p>"}]}],"references":[{"url":"https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"CRITICAL","baseScore":9.6,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"}}],"credits":[{"lang":"en","value":"rexnets via Bugcrowd","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}