MarkLogic Server CVE-2026-85958

Exploitation requires network reachability to an affected MarkLogic Server instance (12.x before 12.1.0 or 11.x before 11.3.7) and the ability to present an authentication token to the server; the core defect is that the server's token-validation logic accepts a token it should reject, so no valid credentials or prior privileges are needed (PR:N, UI:N). The description does not name a specific feature, protocol, or non-default configuration as a precondition, so it appears to affect standard authentication handling rather than an optional mode - this should be confirmed against the vendor bulletin. Limiting factors are primarily deployment-side: the server must be network-exposed to the attacker, and the product's niche enterprise footprint narrows the realistic target population.

Signals are moderate and partially incomplete. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) describes a network-reachable, low-complexity, unauthenticated flaw - strong exploitability metrics consistent with an authentication-bypass (CWE-287) where a token that should be rejected is accepted. No EPSS score, KEV listing, or POC was provided, so there is no public evidence of active exploitation or available exploit code at time of analysis. A notable internal conflict exists: the description states the weakness 'could result in unauthorized access,' which normally implies a confidentiality impact, yet the vendor-supplied vector sets C:N and scores only Integrity (I:H) - verify the intended impact scope with Progress, as unauthorized access to a MarkLogic database would plausibly expose data (C:H) as well. Overall this is a credible, prioritize-for-patching issue on a per-deployment basis given the pre-auth network vector, but absent EPSS/KEV/POC evidence it is not yet demonstrably mass-exploited; its practical risk is bounded by the product's limited deployment footprint rather than by exploit difficulty.

A remote, unauthenticated attacker crafts or reuses an authentication token that the MarkLogic Server should reject but erroneously accepts, and submits it over the network to a reachable server instance. The server treats the request as validly authenticated, granting unauthorized access to protected functionality or data. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means no special timing or race conditions are required once the token-validation flaw is understood.