CVE-2026-85970 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Progress MarkLogic Server versions prior to 12.1.0 and 11.x releases before 11.3.7 stems from the default configuration enabling XML External Entity processing across multiple server endpoints. This architectural decision allows the application parser to resolve external entity references within incoming XML documents, a feature that is frequently exploited by attackers through crafted input payloads. The core technical flaw lies in the lack of strict validation or disabling of external general entities and parameter entities during the parsing phase. When an attacker submits specially constructed XML data containing malicious entity definitions, the server processes these requests without adequate safeguards, leading to unintended side effects such as Server-Side Request Forgery or local file disclosure.
From a technical perspective, this vulnerability aligns with CWE-611, which describes Improper Restriction of XML External Entity Reference. The exploitation mechanism typically involves injecting an entity declaration that references either an internal resource via the file protocol or an external resource controlled by the attacker. In cases involving local file disclosure, the parser resolves the entity against the server's filesystem, allowing sensitive data such as configuration files, source code, or credentials to be returned in the application response. When utilized for Server-Side Request Forgery, the vulnerability enables the attacker to leverage the MarkLogic server’s network privileges to initiate requests to internal services that may not be directly accessible from the external network, potentially facilitating further lateral movement within the infrastructure.
The operational impact of this flaw is significant due to its potential for data exfiltration and unauthorized access to backend systems. If an attacker successfully exploits the local file disclosure aspect, they can gain read-only access to critical system files on the host machine running MarkLogic Server. This information can be used to identify other vulnerabilities or extract authentication credentials stored in configuration directories. Conversely, exploitation via SSRF allows the adversary to probe internal network segments, interact with administrative interfaces of other services like databases or monitoring tools, and potentially pivot into more sensitive parts of the enterprise architecture. The severity is compounded by the fact that this behavior is enabled by default, meaning systems are vulnerable immediately upon installation unless explicitly hardened.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators should upgrade to MarkLogic Server version 12.1.0 or later for the 12.x branch, and version 11.3.7 or later for the 11.x branch, as these releases address the underlying parsing logic flaws. For environments where upgrading is not immediately feasible, it is critical to implement strict input validation on all endpoints that accept XML data. This includes disabling external entity processing at the parser level if the application does not require such functionality. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking common XXE payloads can provide an additional layer of defense. Network segmentation should also be reviewed to limit the server’s ability to make outbound connections or access local file systems from untrusted contexts, thereby reducing the blast radius in case of successful exploitation.
This vulnerability is categorized under ATT&CK technique T1568.002, which covers Dynamic Resolution Techniques specifically focusing on DNS and other protocol-based exfiltration methods often associated with SSRF scenarios where internal resources are accessed via network protocols initiated by the vulnerable application. Understanding this classification helps in aligning detection rules within Security Information and Event Management systems to monitor for anomalous outbound traffic or unusual file access patterns originating from MarkLogic Server processes. Regular security assessments and penetration testing should include specific checks for XXE vulnerabilities to ensure that configuration drift does not reintroduce these risks over time.