Key points
- CVE-2026-85948 affects MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7
- The flaw is an XQuery injection in a deprecated Management API package path
- Attackers with manage-user-level privileges can gain persistent unauthorized administrative access
- National Vulnerability Database rates the severity as critical with a score of 9.9
Progress Software Corporation’s MarkLogic Server contains a critical security flaw that allows remote attackers to take over administrative control. The vulnerability, tracked as CVE-2026-85948, exists in specific older releases of the database management platform. Security researchers and vulnerability databases have highlighted the risk of persistent unauthorized access. This issue impacts organizations relying on these versions for data management and application services.
In plain English
The problem stems from an XQuery injection flaw located within a deprecated Management API package path. XQuery is a language used to query XML data, and injection occurs when untrusted input is processed incorrectly. An attacker does not need full administrative rights to exploit this. They only require manage-user-level privileges, which are often granted to standard operational staff. Once the injection is successful, the attacker gains persistent administrative control over the server.
The background
According to the National Vulnerability Database record, the flaw is classified under CWE-269, which relates to improper privilege management. The CVSS base score is 9.9, placing the severity in the critical range. The affected software versions are MarkLogic Server 11.x releases prior to 11.3.7 and MarkLogic Server 12.x releases prior to 12.1.0. The NVD description states that a remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.
What changes now
Organizations running these specific versions are exposed to remote takeover risks. The presence of a deprecated API path suggests that legacy configurations may be the primary entry point for attackers. Security teams must verify their current server versions immediately. If an environment is running an affected version, the risk of system compromise is high. The source material indicates that versions 11.3.7 and 12.1.0 are the fixed releases, implying that updates exist for these specific version lines.
What to do and how to stay safe: MarkLogic Server
- Audit all MarkLogic Server installations to identify versions prior to 11.3.7 and 12.1.0
- Review access logs for any unusual activity from accounts with manage-user-level privileges
- Isolate affected servers from untrusted networks if immediate version upgrades are not possible
- Monitor vendor communications for official patch releases or mitigation guidance
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific MarkLogic Server versions are affected by CVE-2026-85948?
MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected.
What level of access does an attacker need to exploit this flaw?
An attacker needs manage-user-level privileges to exploit the XQuery injection flaw.
Has a patch or fix been released for this vulnerability?
The source material lists versions 11.3.7 and 12.1.0 as the releases that address the issue.
