Progress patches MarkLogic Server to fix critical CVE-2026-85948 XQuery injection vulnerability
Progress releases updates for MarkLogic Server to address a critical vulnerability that allows remote attackers to seize persistent administrative control.
Key points
- CVE-2026-85948 is rated 9.9 CRITICAL by the National Vulnerability Database.
- The flaw exists in a deprecated Management API package path within MarkLogic Server.
- Affected versions are 11.x before 11.3.7 and 12.x before 12.1.0.
Progress Software Corporation has released security updates for MarkLogic Server to address a critical vulnerability. The flaw, identified as CVE-2026-85948, allows attackers to gain persistent unauthorized administrative control over the database server.
At a glance
- CVE
- CVE-2026-85948
- Product
- Progress Software Corporation MarkLogic Server
- CVSS
- 9.9 Critical
- Weakness
- improper privilege management
- Exploited
- No known exploitation
According to the National Vulnerability Database, the issue carries a CVSS score of 9.9. The vulnerability is classified as CRITICAL due to the severity of the potential impact on system integrity and confidentiality.
Technical Details
The vulnerability stems from an XQuery injection flaw located in a deprecated Management API package path. This specific code path was previously marked for removal but remained active in certain server versions.
An attacker with manage-user-level privileges can exploit this injection flaw. Successful exploitation grants the attacker persistent unauthorized administrative control over the affected MarkLogic Server instance.
The weakness is categorized under CWE-269, which relates to improper privilege management. This classification highlights the risk associated with insufficient access controls in the API implementation.
Affected Versions
Progress MarkLogic Server 11.x releases prior to version 11.3.7 are affected by this vulnerability. Organizations running these older builds remain exposed to remote exploitation attempts.
MarkLogic Server 12.x releases prior to version 12.1.0 are also vulnerable. Users of the latest major version must ensure they have applied the 12.1.0 patch to mitigate the risk.
The vendor has confirmed that versions 11.3.7 and 12.1.0 resolve the issue. These updates remove or fix the insecure code path in the deprecated Management API.
What should you do?
Security teams should immediately verify their MarkLogic Server versions against the affected list. If an organization is running a vulnerable version, they should prioritize updating to 11.3.7 or 12.1.0.
Administrators should review access logs for any suspicious activity from accounts with manage-user-level privileges. This helps identify potential exploitation attempts before they result in full administrative takeover.
Organizations should restrict access to Management API endpoints where possible. Limiting network exposure reduces the attack surface for remote attackers attempting to exploit the injection flaw.
What to do and how to stay safe: MarkLogic Server
- Inventory all MarkLogic Server instances to identify versions prior to 11.3.7 and 12.1.0.
- Apply the latest security patches from Progress Software as soon as possible.
- Monitor server logs for unusual administrative actions or privilege escalation attempts.
- Restrict network access to Management API endpoints to trusted internal IPs only.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-85948?
The National Vulnerability Database rates CVE-2026-85948 as 9.9 CRITICAL.
Which MarkLogic Server versions are vulnerable?
Versions 11.x before 11.3.7 and 12.x before 12.1.0 are affected.
What privileges are needed to exploit this flaw?
An attacker needs manage-user-level privileges to exploit the XQuery injection flaw.
