MajorCritical vulnerability

CVE-2026-85950 (CVSS 8.4)

NVD · officialPublished Oct 12, 2026Risk 37/100

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized administrative access.

Technical details

CVSS

8.4

AV:NetworkAC:LowPR:HighUI:RequiredC:HighI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source