CVE Intelligence
Analysis AI-assisted

CVE-2026-85948: Progress MarkLogic Server Management API: XQuery injection and improper privilege management

CVE-2026-85948 affects Progress MarkLogic Server releases from 11.0.0 before 11.3.7 and from 12.0.0 before 12.1.0. According to the record, an XQuery injection flaw in a deprecated Management API package path could let a remote attacker with manage-user privileges gain persistent unauthorized administrative control. The record carries a CVSS 3.1 base score of 9.9 (critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-85948 is a critical vulnerability in Progress MarkLogic Server. The record describes an XQuery injection flaw in a deprecated package path of the Management API. The CNA classifies the weakness as CWE-269, Improper Privilege Management, which reflects the title of the record.

Impact

  • The record states that a successful attack could give the attacker persistent, unauthorized administrative control.
  • The CVSS 3.1 vector indicates network attack vector, low complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity and availability.
  • The attacker must already hold manage-user level privileges, according to the record.

Affected products and versions

  • Progress Software Corporation MarkLogic Server, from 11.0.0 before 11.3.7.
  • Progress Software Corporation MarkLogic Server, from 12.0.0 before 12.1.0.

The record does not list specific fixed versions. The upper bounds of the affected ranges suggest that 11.3.7 and 12.1.0 are the first unaffected releases in their series, but administrators should confirm this in the vendor bulletin.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed active exploitation appears in the sources consulted. The EPSS probability is 0.00349 (percentile 0.26719), dated 2026-10-13. This is a statistical estimate and does not confirm exploitation.

Remediation and mitigation

  • Review the vendor bulletin and plan an upgrade to a release outside the affected ranges, such as 11.3.7 or 12.1.0 or later, as confirmed by Progress.
  • Restrict who holds manage-user privileges, applying the principle of least privilege.
  • Limit network access to MarkLogic management interfaces to trusted administrative networks.
  • Review whether the deprecated Management API package path is in use and disable it if the vendor guidance permits.

Detection guidance

  • Audit accounts with manage-user privileges and recent changes to their roles or credentials.
  • Review administrative logs for unexpected creation of users, roles or configuration changes.
  • Monitor access to Management API endpoints from unexpected sources.

Limitations of the available information

The record title refers to improper privilege management, while the description refers to XQuery injection. Both appear in the analysis. The record has no fixed-version list, no workaround details and no exploit information from the sources consulted. The CVSS score is supplied by the CNA and matches across two providers. Verify all remediation details against the vendor bulletin.

Frequently asked questions

Which MarkLogic versions are affected by CVE-2026-85948?

The record lists affected ranges from 11.0.0 before 11.3.7 and from 12.0.0 before 12.1.0 for Progress MarkLogic Server.

Is this CVE known to be actively exploited?

No. The CISA KEV catalog does not list it in the record, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.