CVE-2026-85962 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that should be rejected, potentially resulting in unauthorized access.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The identified security flaw resides within the Security Assertion Markup Language (SAML) processing module of Progress MarkLogic Server versions 12.x prior to 12.1.0 and version 11.x prior to 11.3.7. This vulnerability is classified as an improper authentication weakness, specifically falling under Common Weakness Enumeration identifier CWE-287. The core technical issue involves a failure in the validation logic that governs how SAML assertions are processed upon receipt from identity providers. In environments configured for federated identity management using SAML, the server relies on these digital assertions to establish user sessions and determine access privileges without requiring direct credential entry at every interaction point.
The operational impact of this flaw is severe because it allows an unauthenticated remote attacker to bypass authentication controls entirely. By crafting a maliciously formatted or logically flawed SAML assertion that exploits the validation gap, an adversary can trick the MarkLogic server into accepting credentials for which no valid signature or authorization exists. This effectively neutralizes the security boundary provided by the identity provider integration. Consequently, attackers gain unauthorized access to protected resources and data stored within the database system without possessing legitimate user accounts or permissions.
This type of vulnerability aligns with MITRE ATT&CK technique T1078, which covers Valid Accounts, as well as techniques related to authentication bypass such as T1621 in certain contexts where multi-factor or step-up authentication might be circumvented by exploiting trust relationships between systems. The exploitation does not require prior access to the network segment hosting MarkLogic if the SAML endpoint is exposed to untrusted networks, although it typically requires some level of network reachability to send the crafted HTTP requests containing the malicious assertions.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Administrators operating affected versions should upgrade Progress MarkLogic Server to version 12.1.0 or later for the 12.x branch, or version 11.3.7 and above for the 11.x branch, where these validation checks have been corrected. In scenarios where immediate patching is not feasible due to operational constraints, temporary mitigations should include restricting network access to SAML endpoints via firewall rules to only trusted identity provider IP addresses. Additionally, implementing strict logging and monitoring for anomalous authentication patterns can aid in early detection of exploitation attempts while longer-term architectural reviews ensure that defense-in-depth measures are robust against assertion manipulation attacks.