CVE-2026-8709: MarkLogic Server Privilege Escalation Flaw

CVE-2026-8709 Overview

CVE-2026-8709 is an improper privilege management vulnerability [CWE-269] in Progress MarkLogic Server. The flaw resides in the REST API document patch operation and affects versions prior to 11.3.6 and 12.0.3. An authenticated user holding a low-privileged REST role can escalate privileges and execute privileged operations against the Security database. Because the Security database governs authentication, authorization, and role assignment, exploitation gives an attacker administrative control over the database instance.

Critical Impact
A low-privileged authenticated REST user can escalate to administrative control over the MarkLogic Security database, compromising confidentiality, integrity, and availability of the database and any data it protects.

Affected Products

Progress MarkLogic Server versions before 11.3.6
Progress MarkLogic Server 12.x versions before 12.0.3
MarkLogic Server deployments exposing the REST API with document patch operations

Discovery Timeline

2026-08-05 - CVE-2026-8709 published to the National Vulnerability Database
2026-08-05 - Progress publishes the MarkLogic Critical Security Alert Bulletin (August 2026)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-8709

Vulnerability Analysis

The vulnerability is a privilege escalation flaw in the REST API document patch handler of Progress MarkLogic Server. The REST endpoint permits PATCH operations against documents, and the server fails to enforce role-based authorization when the patch payload targets documents in the Security database. An authenticated caller with a low-privileged REST role can craft a patch request that modifies security-relevant documents, effectively performing operations that should be restricted to administrative roles.

The issue is network-reachable and requires only low privileges to exploit. Successful exploitation crosses a security boundary (scope change) because the REST role gains capabilities associated with the Security database, impacting components beyond the caller's own authorization context.

Root Cause

The root cause is improper privilege management [CWE-269] in the REST API document patch code path. Authorization checks for patch operations do not correctly validate that the caller has the required role to modify security documents. Patch payloads therefore reach the storage layer without full role enforcement, allowing modifications to configuration and privilege records maintained inside the Security database.

Attack Vector

An attacker requires valid credentials for a MarkLogic account holding a low-privileged REST role. From an authenticated session, the attacker issues a document patch request over the REST API that targets documents governing users, roles, or privileges. The patch is applied without an adequate authorization check, granting the attacker elevated capabilities. The attacker can then invoke privileged operations, including creating administrative users, altering role assignments, or reading sensitive Security database content.

Refer to the Progress Security Alert Bulletin for vendor technical details.

Detection Methods for CVE-2026-8709

Indicators of Compromise

Unexpected PATCH requests to REST API document endpoints originating from accounts with low-privileged REST roles.
Modifications to Security database documents (user, role, or privilege records) not attributable to administrative workflows.
Creation of new administrative users or role grants outside the normal change-management window.
Authentication events from previously dormant REST accounts followed by privileged operations.

Detection Strategies

Enable MarkLogic audit logging for Security database writes and correlate them with the invoking user's assigned roles.
Alert on REST API PATCH traffic where the request path or payload references security configuration documents.
Baseline REST API usage per account and flag deviations, including unusual request volume or new operation types.

Monitoring Recommendations

Forward MarkLogic access, audit, and error logs to a centralized SIEM for retention and correlation.
Track role assignment changes and administrator account creation as high-priority events.
Monitor network traffic to MarkLogic REST endpoints (default ports 8000, 8002) for anomalous authenticated sessions.

How to Mitigate CVE-2026-8709

Immediate Actions Required

Upgrade Progress MarkLogic Server to version 11.3.6, 12.0.3, or later without delay.
Inventory all REST role assignments and remove roles that are not required for business operations.
Rotate credentials for any account that holds REST roles, especially service and integration accounts.
Review the Security database for unauthorized user, role, or privilege changes since the vulnerability disclosure.

Patch Information

Progress has released fixed builds in MarkLogic Server 11.3.6 and 12.0.3. Details are published in the MarkLogic Critical Security Alert Bulletin (August 2026). Apply the vendor-supplied upgrade to eliminate the flaw; there is no in-product configuration that fully resolves the authorization gap on unpatched builds.

Workarounds

Restrict network access to REST API app servers so that only trusted application tiers can reach them.
Disable or remove REST app servers that are not actively in use until patching is complete.
Enforce least privilege by revoking REST roles from accounts that do not require document patch capability.
Place a reverse proxy or web application firewall in front of MarkLogic REST endpoints to block unexpected PATCH requests to Security database paths.

bash

# Example: restrict inbound access to MarkLogic REST app server ports to trusted subnets
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
iptables -A INPUT -p tcp --dport 8002 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8002 -j DROP