Progress MarkLogic Server: Privilege escalation via higher-order XQuery functions
Summary
MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 can evaluate user-controlled values passed to certain higher-order XQuery functions in an elevated security context. An authenticated attacker with some granted permissions could use this to gain privileges beyond those permissions. The CVSS vector lists no privileges required, which conflicts with the description, so at least a low-privilege account should be assumed.
Affected
- MarkLogic Server 11.0.0 to before 11.3.7
- MarkLogic Server 12.0.0 to before 12.1.0
- Retired releases (10.x and earlier): status conflicting, confirm with Progress
Fixed in
- MarkLogic Server 11.3.7
- MarkLogic Server 12.1.0
- Patch date: conflicting sources (10 September or 12 October 2026), unknown which is correct
Workaround
- No workaround in the CVE record or vendor bulletin reviewed.
- An unverified aggregator suggests restricting higher-order XQuery functions to privileged users; confirm with Progress before applying.
- Restrict who can submit XQuery at all as an interim control.
Exploitation
- CISA KEV: not listed.
- Public exploit: none reported (VulDB).
- In the wild: nothing known; the vendor warns that exploitation may leave no visible signs.
- EPSS 0.00202 at time of search.
Our recommendation
- Check whether MarkLogic Server is in use at all.
- Upgrade to 11.3.7 or 12.1.0, and patch the whole October 2026 bulletin (31 flaws).
- Review access rights after the upgrade, as previously granted privileges may have been incorrect.
- Restrict XQuery access and internet exposure of admin and API endpoints.
- Check logs for unexpected XQuery activity from low-privilege accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Progress MarkLogic Security Alert Bulletin, October 2026 community.progress.com
- OpenCVE CVE-2026-85954 app.opencve.io
- VulDB 416994 vuldb.com
- The Hacker News: Two critical MarkLogic flaws thehackernews.com
- GBHackers: Critical Progress MarkLogic Server vulnerabilities gbhackers.com
- Strix AI CVE-2026-85954 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:47.
Original description (NVD)
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.