MarkLogic Server EUVD-2026-97505

Exploitation requires the attacker to already possess an account with forest-management privileges on a MarkLogic Server running an affected version (12.x before 12.1.0 or 11.x before 11.3.7); it is NOT exploitable by anonymous or unauthenticated users. The vulnerable code path is the authorization handling within certain forest-management operations, which fails to prevent a forest-management role from provisioning a new administrator account. Limiting factors: the prerequisite privilege (PR:L) means only deployments that delegate forest-management rights to non-super-admin roles - e.g., multi-tenant or separated-duty environments - face realistic internal escalation risk; instances where forest-management is restricted to fully trusted administrators have a much smaller practical exposure. No user interaction or non-default product feature toggle is required beyond possessing the privilege and network access to the management interface.

This is a serious, actionable priority for organizations running affected MarkLogic Server versions, though the severity is tempered by one key limiting signal. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) indicates a network-reachable, low-complexity flaw requiring no user interaction, with a scope change and total CIA impact - consistent with privilege escalation (CWE-269) to full administrative control. The critical qualifier is PR:L: the attacker must ALREADY hold forest-management privileges, so this is a privilege-escalation path for an existing low/mid-privileged account rather than a pre-auth remote takeover. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - this appears to be a vendor-reported flaw (Progress Software) with no in-the-wild signal yet. Signals are internally consistent: the 'remote attacker' and AV:N framing align with MarkLogic's network-facing admin/management interfaces, and PR:L aligns with the 'forest-management privileges' prerequisite in the description. The real risk is highest in multi-tenant or delegated-administration deployments where forest-management rights are granted to non-super-admin roles; where only trusted super-admins hold such rights, the practical blast radius is smaller. Treat as high-priority patching for exposed/multi-admin instances; EPSS/KEV absence suggests it is not yet subject to widespread opportunistic exploitation.

An attacker who has obtained an account with forest-management privileges (via phishing, credential reuse, insider access, or over-provisioned delegated roles) invokes the vulnerable forest-management operation over the network. Because the operation fails to properly enforce authorization boundaries, the attacker creates a new, persistent administrator account, escalating from limited forest management to complete administrative control of the MarkLogic Server. No public exploit code or active exploitation is identified at time of analysis; exploitation is low-complexity and requires no user interaction once the prerequisite privilege is held.