Progress MarkLogic Server: Improper privilege management in Management API

Summary

Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 contain an XQuery injection flaw in a deprecated Management API package path, classified by the CNA as improper privilege management (CWE-269). A remote attacker with a manage-user-level account could obtain persistent unauthorized administrative control. The attack requires valid credentials with delegated user-management rights; the vendor reports no known exploitation, and the CVSS score of 9.9 reflects the scope change and total impact.

Affected

• MarkLogic Server 11.0.0 to before 11.3.7
• MarkLogic Server 12.0.0 to before 12.1.0
• Default configuration: unaffected (per CNA record)
• Versions 10.x and earlier: not covered by the assessment (secondary source, unverified)

Fixed in

• 11.3.7
• 12.1.0
• Release date: unclear (sources conflict; check vendor release notes)

Workaround

• Unknown. No workaround is confirmed in the vendor bulletin, which could not be opened directly.
• Interim measures (not vendor-confirmed): restrict who holds manage-user and management roles, review those accounts, and limit Management API access to administrative networks.

Exploitation

• CISA SSVC: exploitation none, not automatable.
• VulDB: no exploit exists at last update.
• No confirmed in-the-wild exploitation or public proof-of-concept reported.
• Not listed in CISA KEV as of October 13, 2026 (secondary report).
• Vendor warns that affected instances may run normally with no prior sign of exploitation.

Our recommendation

• Patch MarkLogic Server to 11.3.7 or 12.1.0 as a priority; 12.0 installations must move to 12.1.0.
• Apply the whole October 2026 vendor bulletin, as related critical issues also provide admin-level paths.
• Review and reduce accounts with manage-user and management roles; enforce strong, unique credentials.
• Check whether any MarkLogic instance is reachable from the internet and restrict Management API access.
• Monitor CISA KEV and vendor channels for exploitation or proof-of-concept reports.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Progress MarkLogic Critical Security Alert Bulletin (October 2026) community.progress.com
• VulDB entry CVE-2026-85948 vuldb.com
• OpenCVE record CVE-2026-85948 app.opencve.io
• Rapid7 via Vulners CVE-2026-85948 vulners.com
• GBHackers: Critical Progress MarkLogic Server vulnerabilities gbhackers.com
• Dev.to: MarkLogic discloses 31 flaws, five rated critical dev.to
• Dev.to: From query access to root in the MarkLogic privilege escalation chain dev.to
• Miztonlabs: Two critical MarkLogic flaws could give delegated managers persistent admin control miztonlabs.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:33.