MarkLogic Server CVE-2026-85966

Exploitation requires an authenticated session on MarkLogic Server with at least limited management permissions (PR:L) - the attacker must already possess a valid, low-privilege management account, which is the primary limiting factor. Affected deployments are MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7; versions at or above those fixes are not exploitable. No user interaction is needed (UI:N) and the flaw is reachable over the network (AV:N) with low complexity (AC:L). Real-world risk is highest in multi-tenant or role-segmented installations where lower-trust operators exist, or as a lateral-movement/privilege-escalation step after an initial account compromise; single-admin or tightly controlled deployments face materially lower exposure.

This is a moderately serious but not top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) describes a network-reachable, low-complexity information-disclosure flaw that requires an authenticated attacker holding at least limited management permissions (PR:L) - so it is NOT a pre-auth 'anyone on the internet' bug. The scope change (S:C) and high confidentiality impact (C:H) elevate the score because the disclosed security-sensitive information can cross a privilege boundary to enable access to protected resources; integrity and availability are unaffected (I:N/A:N). No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so there is no evidence of active exploitation or automatable mass-exploitation - the elevated score is driven by impact and scope, not by observed real-world abuse. In short, the risk is real for environments where lower-privileged management accounts exist (insider or post-compromise lateral-movement scenarios), but absent any exploitation signal this is a 'patch in normal cycle, prioritize for multi-tenant/role-segmented deployments' issue rather than an emergency. Note one tag conflict: the input Tags include 'Authentication Bypass,' but the CWE-200 classification and description point to information exposure by an already-authenticated user, not an authentication bypass - treat the 'Authentication Bypass' label with caution and verify against the Progress advisory.

A user who already holds a limited MarkLogic management role (or an attacker who has phished/compromised such an account) issues requests to the management interface and retrieves security-sensitive information they should not be able to read. That disclosed information is then reused to reach protected resources beyond the attacker's intended permission level. No public exploit code was identified at time of analysis.