CVE-2026-85948

Executive Summary

CVE-2026-85948 is a high-severity XQuery injection flaw in a deprecated Management API package path within Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7. A remote attacker who already holds manage-user-level privileges can abuse this flaw to obtain persistent unauthorized administrative control of the affected server. The vulnerability carries a CVSS v3.1 base score of 9.9, reflecting high confidentiality, integrity, and availability impact with a scope change, and no public PoC, exploit code, or Nuclei template is currently available.

Technical Analysis

MarkLogic Server is a multi-model NoSQL database platform that exposes a REST-based Management API for administrative operations. The Management API is natively implemented in XQuery, the query and programming language of the MarkLogic platform. XQuery evaluation of user-influenced input is the root condition for this vulnerability class.

Per the CVE description, the flaw resides in "a deprecated Management API package path." A deprecated endpoint or package continues to be reachable after it is superseded, which means input submitted to that legacy path is still passed into an XQuery evaluation context. The vulnerability is classified under CWE-269 (Improper Privilege Management), which indicates the core weakness is not simply malformed query handling but the failure to correctly constrain, validate, or downgrade the privileges under which attacker-supplied XQuery is executed.

The attack surface is the network-exposed Management API. The CVSS vector (AV:N) confirms remote reachability; the PR:L component confirms that authentication as a manage-user-level account is required before the flaw can be triggered. This is a meaningful precondition: the attacker is not anonymous, but a low-privileged administrative operator — or anyone who has compromised such an account — can escalate beyond their granted role.

The scope change (S:C) is the pivotal detail. It means the vulnerability in the Management API component can affect resources beyond that component's own security authority — consistent with an injection that lets XQuery run with, or be used to acquire, privileges higher than the caller legitimately holds. The combination of C:H/I:H/A:H indicates the attacker can read, modify, and disrupt all data and administrative state reachable by the platform.

No CVE description field provides specific package names, endpoint paths, parameter names, or function names beyond "a deprecated Management API package path." Those implementation specifics are not available in the supplied intelligence and are not inferred here.

Exploitation Scenarios

The following chain is derived strictly from the vulnerability class (XQuery injection in a deprecated Management API path, CWE-269 privilege mismanagement) and the stated preconditions. No public PoC is available; the attack chain is inferred at the vulnerability-class level.

1. Reconnaissance and target identification. The attacker identifies an internet- or network-reachable MarkLogic Server instance and determines its major version (11.x or 12.x). Guidance targeting the Management API is relevant. The attacker must confirm the instance meets the version precondition: 12.x before 12.1.0 or 11.x before 11.3.7.

2. Credential acquisition. The attacker must already possess or obtain a manage-user-level account. This may be a legitimate low-privileged administrative operator, a shared service account, or an account obtained through prior credential compromise. No authentication bypass is claimed here — the PR:L metric confirms valid credentials are required to reach the vulnerable functionality.

3. Triggering the flaw. The attacker directs crafted input to the deprecated Management API package path. Because the path evaluates that input in an XQuery context without adequately constraining the executing privilege set, the injected XQuery executes in a manner that exceeds the caller's intended authority. At the vulnerability-class level, this is analogous to injection flaws where untrusted input reaches an interpreter: the interpreter honors the attacker's expression rather than confining it to the caller's role.

4. Post-exploitation impact. Successful injection permits the attacker to obtain persistent unauthorized administrative control. "Persistent" implies the attacker can establish continued administrative access surviving session termination — for example by manipulating platform administrative state reachable through the escalated XQuery execution context. Once administrative control is achieved, the attacker has full read/write access to databases and configuration, enabling data exfiltration, tampering, and service disruption, consistent with the C:H/I:H/A:H subscores.

No CVE description field identifies specific XQuery operators, escaped characters, endpoint URLs, or payload syntax; therefore no such specifics are provided.

Impact Assessment

The business impact is severe. MarkLogic Server is frequently deployed as the system of record behind content, search, and analytics applications. Administrative control of the platform potentially exposes every database, document, and configuration parameter on the cluster to an attacker. The scope-change metric indicates the compromise propagates beyond the Management API into the broader data platform, so a single low-privileged administrative credential can be leveraged into full control.

Blast radius considerations: any organization running MarkLogic Server 11.x prior to 11.3.7 or 12.x prior to 12.1.0 with a network-reachable Management API and personnel or service accounts holding manage-user-level privileges is in scope. Because the flaw affects a platform rather than a single application, downstream applications that rely on MarkLogic data inherit the confidentiality and integrity risk.

CVSS subscore interpretation: AV:N — remotely exploitable over the network; AC:L — no special conditions beyond valid credentials; PR:L — low privilege required (manage-user); UI:N — no user interaction; S:C — impact crosses a security boundary; C:H/I:H/A:H — total loss of confidentiality, integrity, and availability of affected resources. The resulting score is 9.9. No EPSS score has been published by FIRST.org, and the CVE is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: MarkLogic Management API XQuery Injection Attempt (CVE-2026-85948)
id: 8f2a1c74-3b6e-4d51-9a0f-7c2e5b1d6f83
status: experimental
description: Detects requests targeting the deprecated MarkLogic Management API package path with XQuery-style injection characters.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85948
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: marklogic
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/manage/'
      - '/manage/v2/'
  selection_injection:
    cs-uri-query|contains:
      - 'xquery'
      - 'xdmp:'
      - 'declare'
      - '&#x'
      - ']]>'
      - '("}'
  condition: selection_path and selection_injection
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
  - cs-username
falsepositives:
  - Legitimate administrative scripts using XQuery features against the Management API
level: high

YARA Rule

rule CVE_2026_85948_MarkLogic_XQuery_Injection
{
    meta:
        description = "Detects XQuery injection payloads targeting the deprecated MarkLogic Management API package path"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85948"
        date = "2026-01-01"
        severity = "high"
    strings:
        $ml1 = "/manage/v2/" ascii nocase
        $ml2 = "manage-user" ascii nocase
        $xq1 = "xdmp:" ascii nocase
        $xq2 = "declare namespace" ascii nocase
        $xq3 = "import module" ascii nocase
        $inj1 = "]]>" ascii
        $inj2 = "&#x" ascii
    condition:
        any of ($ml*) and any of ($xq*) or ($ml1 and any of ($inj*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85948 MarkLogic Management API XQuery Injection Attempt"; flow:established,to_server; http.uri; content:"/manage/"; http.uri; content:"xquery"; nocase; http.uri; content:"xdmp:"; nocase; threshold:type limit, track by_src, count 5, seconds 60; classtype:web-application-attack; reference:cve,2026-85948; sid:202685948; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.protocol == "http" and url.path : "/manage/*" and url.query : "*xquery*" ]
  [ network where network.protocol == "http" and url.path : "/manage/*" and (url.query : "*xdmp:*" or url.query : "*declare*" or url.query : "*]]>*") ]

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="/manage/*" OR uri_path="/manage/v2/*")
| search (uri_query="*xquery*" OR uri_query="*xdmp:*" OR uri_query="*declare*" OR uri_query="*]]>*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query, user
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,marklogic,">
  <rule id="100948" level="12">
    <if_sid>31100</if_sid>
    <url>manage</url>
    <match>xquery|xdmp:|declare|&#x|]]&gt;</match>
    <description>CVE-2026-85948: Possible MarkLogic Management API XQuery injection attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Restrict network access to the Management API. Where the deprecated Management API package path is not operationally required, block it at the reverse proxy, WAF, or host firewall.
   • Enforce least privilege on manage-user accounts: audit all accounts with manage-user-level privileges and revoke or downgrade those that are not strictly required.
   • Rotate credentials for any manage-user or administrative accounts, and enable multi-factor authentication at the access layer in front of the Management API.
   • Apply WAF rules to inspect and block XQuery metacharacter patterns directed at Management API paths.

2. Patch/upgrade steps.

   • Upgrade MarkLogic Server 12.x deployments to 12.1.0 or later.
   • Upgrade MarkLogic Server 11.x deployments to 11.3.7 or later.
   • Because no vendor fix is confirmed by any tracked patch source, validate the actual release notes and vendor security advisory before relying on a specific build. Stage the upgrade in a non-production cluster first, then roll out.

3. Long-term hardening.

   • Retire deprecated API surface entirely rather than relying on its continued, reachable presence.
   • Adopt strict input validation and output encoding at every API boundary, and preclude direct evaluation of untrusted input in platform query languages such as XQuery.
   • Segment the Management API onto a dedicated administrative network with no internet exposure.
   • Continuously monitor for exploitation attempts against Management API paths and alert on XQuery metacharacters in administrative requests.
   • Track Progress MarkLogic security advisories for confirmation of an authoritative fix and re-validate patch confidence.

References

• NVD — CVE-2026-85948: https://nvd.nist.gov/vuln/detail/CVE-2026-85948
• MITRE CWE-269 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Progress MarkLogic Server product and security advisories: https://www.progress.com/marklogic
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE at the time of writing. No threat actor campaign or exploit-in-the-wild evidence has been confirmed, and the CVE is not listed in CISA KEV. EPSS has not yet scored this vulnerability.