MarkLogic Server Flaw Allows Code Execution Without Extra Privileges
A critical vulnerability in Progress MarkLogic Server lets attackers with query access run code with elevated permissions, according to NVD data.
Key points
- CVSS score is 9.9, rated critical by the National Vulnerability Database.
- Affected versions include MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0.
- Attackers need query-execution access to exploit the XQuery evaluation function flaw.
Progress MarkLogic Server contains a critical security flaw that allows remote attackers to execute server-side code with elevated permissions. The National Vulnerability Database lists the issue as CVE-2026-85955 with a CVSS score of 9.9.
At a glance
- CVE
- CVE-2026-85955
- Product
- Progress Software Corporation MarkLogic Server
- CVSS
- 9.9 Critical
- Weakness
- improper privilege management
- Exploited
- No known exploitation
The vulnerability exists because the server permits users with query-execution access to invoke an XQuery evaluation function. This action bypasses the additional required evaluation privilege, leading to unauthorized code execution.
Technical Context and Severity
The National Vulnerability Database assigns a CVSS score of 9.9 to CVE-2026-85955, classifying the severity as critical. The flaw is associated with weakness CWE-269. The description notes that the issue allows invocation of an XQuery evaluation function without the additional required evaluation privilege.
According to the NVD record, the weakness is categorized under CWE-269. The specific mechanism involves the ability to invoke an XQuery evaluation function without the additional required evaluation privilege.
Who Is Affected
Progress Software Corporation’s MarkLogic Server is affected in specific version ranges. Users running MarkLogic Server 11.x releases prior to version 11.3.7 are vulnerable to this attack vector. Similarly, those using MarkLogic Server 12.x releases before version 12.1.0 face the same risk.
Organizations must verify their current server versions against these thresholds. Any installation below the specified safe versions lacks the necessary controls to prevent this privilege escalation.
What should you do?
Security teams should immediately inventory their MarkLogic Server deployments to identify affected versions. If systems are running versions prior to 11.3.7 or 12.1.0, they are exposed to this critical flaw.
Monitor network traffic for unusual XQuery requests or unexpected code execution patterns. Restrict query-execution access to only those users who strictly require it for legitimate operations.
What to do and how to stay safe: Progress
- Audit all MarkLogic Server instances to confirm current version numbers against the affected ranges.
- Restrict query-execution permissions to minimize the number of users who can trigger the flaw.
- Monitor server logs for unauthorized XQuery evaluation attempts or unexpected privilege escalations.
- Prepare to apply vendor updates once Progress releases patches for versions 11.3.7 and 12.1.0.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-85955?
The National Vulnerability Database rates CVE-2026-85955 with a CVSS score of 9.9, which is classified as critical.
Which MarkLogic Server versions are vulnerable?
MarkLogic Server 11.x releases before 11.3.7 and 12.x releases before 12.1.0 are affected by this vulnerability.
What access level is required to exploit this flaw?
A remote attacker needs query-execution access to invoke the XQuery evaluation function without the required privilege.
