CVE-2026-85948
Received Received - Intake

XQuery Injection in Progress MarkLogic Server

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Progress Software Corporation

Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-85948
EUVD
EUVD-2026-97506

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Progress Software Corporation MarkLogic Server 11.0.0
Progress Software Corporation MarkLogic Server 12.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an XQuery injection flaw in Progress MarkLogic Server versions before 12.1.0 and 11.3.7. It exists in a deprecated Management API package path and allows a remote attacker with manage-user-level privileges to gain persistent unauthorized administrative control of the system.

Impact Analysis

An attacker could exploit this flaw to take full administrative control of your MarkLogic Server, potentially leading to data breaches, unauthorized modifications, or system disruption. This requires the attacker to already have manage-user-level access.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, and other regulations. It risks exposing sensitive data and failing audits due to inadequate access controls.

Mitigation Strategies

Upgrade MarkLogic Server to version 12.1.0 or later if using 12.x, or to version 11.3.7 or later if using 11.x. Remove or restrict access to the deprecated Management API package path to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85948. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart