CVE-2026-85954
Received Received - Intake

Privilege Escalation in Progress MarkLogic Server

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Progress Software Corporation

Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-85954
EUVD
EUVD-2026-97516

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Progress Software Corporation MarkLogic Server 11.0.0
Progress Software Corporation MarkLogic Server 12.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Progress MarkLogic Server versions before 12.1.0 and 11.3.7. It allows user-controlled values in certain XQuery functions to be evaluated with elevated privileges, potentially letting attackers gain permissions beyond their granted access.

Impact Analysis

An attacker could exploit this to escalate privileges, gaining unauthorized access to sensitive data or system functions. This could lead to data breaches, unauthorized modifications, or full system compromise depending on the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of regulated data, violating GDPR, HIPAA, or other compliance requirements. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance.

Mitigation Strategies

Upgrade MarkLogic Server to version 12.1.0 or later if using 12.x, or to 11.3.7 or later if using 11.x. Apply the latest patches immediately to prevent privilege escalation attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85954. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart