CVE Intelligence
Analysis AI-assisted

CVE-2026-85955: Progress MarkLogic Server improper privilege management in XQuery evaluation

Progress reported that MarkLogic Server releases in the 11.x line before 11.3.7 and the 12.x line before 12.1.0 can let a remote attacker with query-execution access invoke an XQuery evaluation function without the additional evaluation privilege. The record rates the issue critical with a CVSS 3.1 base score of 9.9 and describes possible server-side code execution with elevated permissions. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CNA Progress Software records CVE-2026-85955 as an improper privilege management issue, classified as CWE-269. According to the record, a remote attacker with query-execution access can reach an XQuery evaluation function without the additional evaluation privilege that should be required.

Impact

  • The record describes possible server-side code execution with elevated permissions.
  • The CVSS 3.1 base score is 9.9 (critical), with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, as recorded from the security@progress.com and ProgressSoftware entries.
  • The vector records a changed scope and high confidentiality, integrity and availability impact.

Affected products and versions

  • Progress Software Corporation MarkLogic Server, 11.x releases before 11.3.7.
  • Progress Software Corporation MarkLogic Server, 12.x releases before 12.1.0.
  • The record's version ranges are 11.0.0 up to but excluding 11.3.7, and 12.0.0 up to but excluding 12.1.0.

Exploitation status

The CVE is not listed in the CISA KEV catalog in this record. No confirmed exploitation or active exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Consult the vendor bulletin Marklogic Critical Security Alert Bulletin October 2026 for the authoritative fixed releases and guidance.
  • The record does not list fixed versions. The affected ranges indicate that releases below 11.3.7 and below 12.1.0 are in scope.
  • While planning the upgrade, restrict query-execution access to trusted users only and limit network exposure of the server, as general defensive hardening.
  • Inventory every MarkLogic instance, including non-production and disaster recovery nodes, and confirm each running version.

Detection guidance

  • Build an inventory of MarkLogic versions and flag any instance below the thresholds above.
  • Review authentication and query logs for unexpected query activity from accounts that hold query-execution access.
  • Watch for unexpected server behavior after incidents or changes. The record does not provide specific indicators of compromise.

Limitations of the available information

  • The record contains one vendor reference and no technical details beyond the description.
  • The record has no fixed version field, so exact patched build numbers must be confirmed with the vendor.
  • The EPSS probability is 0.00446 with percentile 0.37057, dated 2026-10-13. This is a statistical estimate, not evidence of exploitation.
  • The source status is Awaiting Analysis, so details derived from NVD may change.

Frequently asked questions

Is CVE-2026-85955 being actively exploited?

The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. Monitoring should continue as the record is still awaiting analysis.

Which MarkLogic versions are affected?

According to the record, 11.x releases before 11.3.7 and 12.x releases before 12.1.0 are in scope. Confirm your exact build with the vendor bulletin.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.