CVE-2026-85955 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Progress MarkLogic Server versions prior to 12.1.0 and 11.x releases before 11.3.7 represents a critical authorization bypass that allows for remote code execution. This flaw stems from an insufficient access control mechanism within the XQuery evaluation subsystem. Specifically, certain internal functions designed for evaluating XQuery expressions do not properly enforce privilege checks required by the application's security model. An attacker who possesses basic query-execution privileges can exploit this gap to invoke these specific evaluation functions without holding the additional elevated permissions that should be mandatory for such operations. This discrepancy between the intended access policy and the actual enforcement logic creates a pathway for unauthorized escalation of privileges, fundamentally undermining the integrity of the server's security boundaries.
From a technical perspective, XQuery is a powerful query language used extensively in MarkLogic Server to retrieve and manipulate data stored in its native XML database engine. The vulnerability arises because the application fails to validate whether the calling context has the necessary rights before executing high-impact functions within this evaluation layer. By leveraging these unchecked functions, an attacker can execute arbitrary code on the server with elevated permissions, effectively bypassing role-based access controls. This type of flaw is characteristic of improper privilege management where the system trusts input or function calls without verifying the caller's actual authorization level against a comprehensive list of required rights. The impact is severe because it allows a low-privileged user to gain high-level administrative control over the database server, potentially leading to complete compromise of the underlying infrastructure and data confidentiality.
The operational impact of this vulnerability extends beyond simple unauthorized access. Once an attacker achieves elevated permissions through code execution, they can modify or delete critical data, exfiltrate sensitive information, or use the compromised server as a pivot point for further attacks within the network. The ability to execute arbitrary commands means that the integrity and availability of the MarkLogic Server are also at risk. Attackers could deploy malware, establish persistence mechanisms, or disrupt services by manipulating system configurations. This scenario highlights the critical importance of strict separation of duties and least privilege principles in database administration tools. Failure to adhere to these principles can result in cascading failures where a single misconfiguration leads to total system compromise.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves an actor obtaining privileges they are not authorized to have. Furthermore, the exploitation technique maps to MITRE ATT&CK techniques related to privilege escalation and command execution within a database environment. The attack vector is remote if query-execution access can be obtained over the network, making this a high-risk issue for internet-facing deployments or internal networks with broad user access policies. Defense in depth strategies are essential here; while patching is the primary remediation, organizations should also implement strict firewall rules to limit exposure of database ports and enforce strong authentication mechanisms such as multi-factor authentication to reduce the likelihood of initial compromise leading to exploitation.
To mitigate this risk, administrators must immediately apply the vendor-provided patches for MarkLogic Server version 12.1.0 or later, or version 11.3.7 and later for the 11.x branch. These updates correct the access control logic within the XQuery evaluation functions to ensure that all required privileges are verified before execution proceeds. In addition to patching, organizations should review their current user roles and permissions to ensure that query-execution rights are granted only to users who genuinely require them. Regular security audits of database configurations and continuous monitoring for anomalous activity can help detect potential exploitation attempts early. It is also advisable to restrict network access to the MarkLogic Server interfaces to trusted IP ranges, thereby reducing the attack surface available to remote adversaries seeking to exploit this vulnerability.