Patch MarkLogic Server Now to Block Privilege Escalation in CVE-2026-85955
A critical flaw in MarkLogic Server allows remote attackers to execute code with elevated permissions by bypassing required privilege checks.
Key points
- Progress MarkLogic Server versions before 11.3.7 and 12.1.0 are affected by a critical vulnerability.
- Remote attackers with query-execution access can invoke XQuery evaluation without proper privileges.
- The flaw carries a CVSS score of 9.9 and enables server-side code execution with elevated permissions.
Progress MarkLogic Server administrators must apply updates immediately to address a critical security flaw that allows remote attackers to execute code with elevated permissions. The vulnerability, identified as CVE-2026-85955, affects specific versions of the database software and poses a significant risk to organizations relying on these systems for data management.
The risk
The National Vulnerability Database records CVE-2026-85955 with a CVSS score of 9.9, classifying it as critical. This rating reflects the severity of the issue, which stems from improper privilege management within the server's architecture. According to the NVD record, the weakness aligns with CWE-269, indicating a failure to properly manage privileges.
Attackers who possess query-execution access to the MarkLogic Server can exploit this flaw to invoke an XQuery evaluation function. Normally, this action requires additional specific evaluation privileges. However, the vulnerability allows the attacker to bypass these security checks entirely. This bypass enables the execution of server-side code with elevated permissions, potentially leading to full system compromise.
Who is exposed
Progress Software Corporation’s MarkLogic Server is the affected product. The vulnerability impacts two major version lines of the software. Specifically, MarkLogic Server 11.x releases prior to version 11.3.7 are vulnerable. Similarly, MarkLogic Server 12.x releases prior to version 12.1.0 contain this security flaw.
Organizations running these older versions expose their infrastructure to remote attacks. Any user or service account that has been granted query-execution access to the database becomes a potential entry point for exploitation. The remote nature of the attack means that physical access to the server is not required for a successful breach.
Cost and compliance
The source material does not provide specific data regarding financial costs or regulatory compliance impacts associated with this vulnerability. No details on incident response expenses, downtime costs, or compliance framework violations are included in the NVD record. Organizations should assess their own risk tolerance and compliance requirements when prioritizing remediation efforts.
Our take on the response
That suggests immediate patching is the only viable mitigation for exposed systems. Managers should verify their current MarkLogic Server versions against the affected ranges and prioritize updates for any instances with external or broad internal query access. Delaying remediation leaves the system open to remote exploitation with elevated privileges.
Background: Incident response plans
An incident response plan for cyber attack is a predefined set of instructions that dictates how your team detects, contains, and recovers from security events. It reduces decision fatigue during crises, limits financial damage, and ensures legal compliance by assigning clear roles and communication protocols before any threat materializes.
Read the full guide: Incident Response Plan for Cyber Attack: Structure and Execution
What to do and how to stay safe: MarkLogic Server
- Inventory all MarkLogic Server installations to identify versions prior to 11.3.7 and 12.1.0.
- Restrict query-execution access to only those users and services that strictly require it.
- Monitor server logs for unusual XQuery evaluation activities or unexpected privilege escalations.
- Apply the vendor-provided updates as soon as they are available to patch the vulnerability.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which MarkLogic Server versions are affected by CVE-2026-85955?
MarkLogic Server 11.x releases before 11.3.7 and 12.x releases before 12.1.0 are affected.
What is the CVSS score for this vulnerability?
The CVSS score for CVE-2026-85955 is 9.9, which is classified as critical.
How can an attacker exploit this flaw?
A remote attacker with query-execution access can invoke an XQuery evaluation function without the required evaluation privilege.
