MarkLogic Server CVE-2026-85961

Exploitation requires ALL of: (1) a MarkLogic Server Azure deployment running an affected build (12.x before 12.1.0 or 11.x before 11.3.7); (2) a 'certain configuration' that causes the server to write security-sensitive authentication information into diagnostic logs - this is a non-default/conditional behavior, not the shipped default; and (3) the attacker having read access to those diagnostic logs. Limiting factors: the attacker must already reach the logs (via log storage, aggregation tooling, or insider/lateral access), the triggering configuration must be present, and only Azure deployments are affected - on-prem and non-Azure deployments appear out of scope. Impact is confidentiality-only (leaked credentials/secrets); there is no direct code execution, integrity, or availability effect in the vulnerability itself.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H) scores 7.5 and describes a remote, unauthenticated, low-complexity confidentiality breach - but this CONFLICTS with the description and CWE-532 (sensitive information in log file). The description explicitly states the attack requires 'an attacker with access to the affected logs' and that logging only occurs 'under certain configurations' on 'Azure deployments,' which implies a non-default configuration plus pre-existing access to diagnostic logs rather than true network-unauthenticated exploitation - verify authentication/access model with vendor. No EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no public exploit identified at time of analysis. Net assessment: this is a real but conditional secondary-exploitation issue (credential/secret leakage enabling follow-on cloud access), not a directly weaponizable remote CRITICAL. The headline CVSS likely overstates real-world risk because it treats log access as free; realistic priority is moderate and gated on whether an organization runs the vulnerable versions on Azure with the triggering configuration and has broad access to its diagnostic logs.

An attacker who can read MarkLogic Server diagnostic logs - for example through a misconfigured or over-shared Azure log store, a log-aggregation pipeline, or insider/lateral access - harvests authentication secrets that the server recorded under certain configurations, then reuses those secrets to reach protected cloud resources. No public exploit code was identified in the provided data; exploitation hinges on log access rather than a crafted network payload.