CVE-2026-85948 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified affects Progress MarkLogic Server versions within the 12.x series prior to release 12.1.0 and the 11.x series prior to release 11.3.7. This security issue resides specifically within a deprecated Management API package path, which serves as an interface for administrative operations on the database server. The core technical flaw is classified as XQuery injection, a type of code injection vulnerability where untrusted input is improperly concatenated into or interpreted as part of an XQuery script. In this context, the application fails to sufficiently validate or sanitize user-supplied data before incorporating it into dynamic XQuery execution contexts within the management interface.
An attacker possessing manage-user-level privileges can exploit this flaw by crafting malicious XQuery payloads that are executed with elevated permissions inherent to the management API. Although the requirement for existing administrative credentials might seem like a limiting factor, the severity lies in the ability of an authenticated user to escalate their access or maintain persistent control over the system even if they were initially granted limited manage rights. By injecting arbitrary commands through this vector, the attacker can execute server-side operations that bypass intended security boundaries, effectively gaining unauthorized administrative control. This capability allows for comprehensive manipulation of database contents, configuration settings, and potentially other servers within a cluster environment managed by MarkLogic.
The operational impact of this vulnerability is significant due to the potential for persistent unauthorized access. Once exploited, an attacker can establish backdoors or modify system configurations in ways that survive subsequent restarts or security patches if not properly audited. This persistence complicates incident response and remediation efforts, as standard privilege revocation may not remove code injected directly into the database logic via XQuery injection. The ability to obtain administrative control means that sensitive data can be exfiltrated, integrity of stored information can be compromised through unauthorized modifications, and availability can be disrupted by disrupting core services or consuming excessive resources through malicious queries.
From a classification perspective, this vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), specifically focusing on the injection of XQuery code. It also maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, particularly those involving server-side script execution by an authenticated user. The use of a deprecated API path suggests that legacy interfaces may not receive the same level of input validation rigor as modern endpoints, highlighting the risk associated with maintaining backward compatibility without adequate security hardening.
Mitigation strategies should prioritize immediate upgrading to MarkLogic Server version 12.1.0 or later for users on the 12.x branch, and version 11.3.7 or later for those on the 11.x branch. These releases contain patches that address the input validation flaws within the deprecated Management API package path. In environments where upgrading is not immediately feasible, administrators should restrict access to the affected management endpoints using network-level controls such as firewalls or reverse proxies, ensuring that only trusted internal systems can reach these interfaces. Additionally, implementing strict role-based access control (RBAC) policies and auditing all administrative actions can help detect exploitation attempts early. Regular security audits of deprecated APIs are recommended to identify similar injection points in legacy code paths before they can be leveraged by attackers seeking persistent unauthorized access.