CVE-2026-85951

Executive Summary

CVE-2026-85951 is a server-side request forgery (SSRF) vulnerability in Progress MarkLogic Server affecting 12.x releases before 12.1.0 and 11.x releases before 11.3.7 when deployed on Microsoft Azure. An authenticated attacker can abuse server-side request functionality to reach internal cloud services, potentially obtaining cloud credentials or tokens and pivoting into the underlying Azure environment. With a CVSS base score of 8.5 and a scope change (S:C), the flaw can compromise resources beyond the MarkLogic host itself.

Technical Analysis

The vulnerability is an instance of CWE-918 (Server-Side Request Forgery). MarkLogic Server, when hosted on Azure, issues server-side HTTP requests as part of its normal operation. Because the server's request handling does not adequately restrict the destinations it may contact, an authenticated user can cause the MarkLogic process to make requests to internal, non-public endpoints — including the Azure Instance Metadata Service and other internal cloud service endpoints reachable from the host's network position.

The core issue is a missing or insufficient allow-list / SSRF guard on outbound request destinations. The MarkLogic server process typically runs with an attached managed identity or workload identity context, so requests originating from it are made with the instance's network identity. This is what elevates the impact: the SSRF does not merely perform port scanning or internal service enumeration — it can retrieve cloud credentials or tokens that the instance is entitled to.

CVSS analysis (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N):

• AV:N — exploitable over the network via the MarkLogic API surface.
• AC:L — no special conditions; no race or unusual configuration required.
• PR:L — attacker must be authenticated; this is the principal gating factor.
• UI:N — no user interaction required.
• S:C — successful exploitation can affect components beyond the vulnerable MarkLogic instance (the cloud control plane, identity services).
• C:H — high confidentiality impact, consistent with credential/token theft.
• I:L — limited integrity impact; a stolen token could permit constrained write operations.
• A:N — no direct availability impact.

The "on Azure" qualifier in the description is material. The same code path on other hosting environments may not expose a metadata service with attachable credentials, so the critical asset exposure is specific to Azure IaaS/PaaS deployments.

No public proof-of-concept, exploit code, or Nuclei template is currently available. The attack chain below is therefore described at the vulnerability-class level rather than tied to specific request payloads.

Exploitation Scenarios

1. Reconnaissance / target identification. The attacker identifies an Internet-reachable (or otherwise accessible) MarkLogic Server instance running an affected 12.x (< 12.1.0) or 11.x (< 11.3.7) release on Azure. This can be done via Shodan/censys queries for MarkLogic service banners and by confirming the version string. The attacker must then obtain valid credentials for a MarkLogic account — legitimately provisioned low-privilege accounts are sufficient, since PR:L applies.

2. Triggering the SSRF. Using their authenticated session, the attacker invokes the MarkLogic functionality that causes the server to fetch a user-influenced URL. Because destination validation is missing, the request is not confined to an expected host set. The attacker supplies a destination that points at an internal address reachable from the MarkLogic host, rather than an external resource.

3. Payload/execution at the class level. The exploitation primitive is a request whose destination is controlled by the attacker. The canonical SSRF target in Azure is the instance metadata endpoint (169.254.169.254), which is only reachable from the instance and can return identity tokens when the instance has a managed identity assigned. The attacker causes MarkLogic to issue the request on their behalf, then reads the response to extract the token or credential material. No public PoC exists; the specific request path and parameter used to inject the URL are not disclosed in the available NVD data and are not asserted here.

4. Post-exploitation impact. With an Azure identity token or cloud credential obtained via SSRF, the attacker can authenticate to Azure control-plane or data-plane services consistent with the identity's role assignments. This can enable enumeration of the subscription/resource group, access to storage or key vault resources, lateral movement within the cloud tenant, and in some configurations persistence through the creation of additional identities or credentials. The S:C rating reflects this cross-boundary reach.

Impact Assessment

Business impact centers on cloud identity compromise rather than the MarkLogic application itself. A stolen Azure token can be used outside the MarkLogic trust boundary, which is why the confidentiality impact is high (C:H) and scope is changed (S:C). Affected systems are any MarkLogic 12.x (< 12.1.0) or 11.x (< 11.3.7) deployment hosted on Azure. Because exploitation requires only network access plus a valid low-privilege MarkLogic account, both external attackers with stolen credentials and malicious insiders are viable threat actors. Blast radius is determined by the Azure managed identity's permissions: a narrowly scoped identity limits damage to the immediate resource group, while an over-privileged identity can expose the wider subscription. Integrity impact is limited (I:L) because token abuse typically targets read/enumeration first, though some write operations may be possible. Availability is not directly affected (A:N).

Detection Guidance

Sigma Rule

title: MarkLogic Server SSRF Attempt Against Azure Instance Metadata Service
id: 8f1b3c2d-5a4e-4f7b-9d21-6c0e9b7a4f33
status: experimental
description: Detects outbound HTTP requests from the MarkLogic process to link-local or internal cloud metadata addresses, indicative of CVE-2026-85951 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85951
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.918
logsource:
  category: network_connection
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\java.exe'
      - '\MarkLogic.exe'
  selection_dst:
    DestinationIp:
      - '169.254.169.254'
      - '168.63.129.16'
  condition: selection_proc and selection_dst
falsepositives:
  - Legitimate Azure platform telemetry initiated by the host agent rather than MarkLogic
level: high

YARA Rule

rule CVE_2026_85951_MarkLogic_SSRF
{
    meta:
        description = "Detects references to internal cloud metadata endpoints in MarkLogic-related files/artifacts, indicative of SSRF targeting (CVE-2026-85951)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85951"
        date = "2026-01-01"
        severity = "high"
    strings:
        $meta_ip = "169.254.169.254" ascii wide
        $azure_meta = "metadata.azure.com" ascii wide nocase
        $metadata_path = "metadata/instance" ascii wide nocase
        $token_path = "metadata/identity/oauth2/token" ascii wide nocase
    condition:
        uint16(0) == 0x4D5A or filesize > 0 and
        (2 of them)
}

Suricata IDS Rule

alert http $HOME_NET any -> 169.254.169.254 any (msg:"CVE-2026-85951 MarkLogic Server SSRF Attempt to Azure Metadata Service"; flow:established,to_server; http.host; content:"169.254.169.254"; http.uri; content:"metadata/instance"; nocase; referer; content:"MarkLogic"; nocase; classtype:attempted-recon; sid:202685951; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-85951;)

Elastic Detection

network where DestinationIp in ("169.254.169.254", "168.63.129.16") and
process.name in ("java.exe", "MarkLogic.exe") and
network.direction == "outbound"

Splunk SPL Query

index=network OR index=proxy
| search (dest_ip="169.254.169.254" OR dest_ip="168.63.129.16")
| eval ssrf_hit=if((like(url,"%169.254.169.254%") OR like(url,"%metadata/instance%") OR like(url,"%metadata/identity%")), 1, 0)
| where ssrf_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, url, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="marklogic,ssrf,cve-2026-85951,">
  <rule id="2026851" level="12">
    <decoded_as>json</decoded_as>
    <field name="dest_ip">169.254.169.254</field>
    <description>CVE-2026-85951: MarkLogic Server SSRF to Azure Instance Metadata Service detected from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Restrict outbound network egress from MarkLogic hosts so they cannot reach link-local (169.254.169.254) or internal Azure platform addresses unless explicitly required. Segment the MarkLogic subnet with NSG/firewall rules and default-deny egress to metadata and non-application endpoints.
• Set the Azure IMDS access to disabled at the host level where supported (e.g., disable or constrain public/metadata access), and avoid assigning managed identities to MarkLogic hosts unless required. Where required, scope identities to least privilege.
• Enforce strong authentication and least privilege on MarkLogic accounts, since exploitation requires PR:L. Rotate credentials for any account with access to MarkLogic APIs.
• Monitor and alert on outbound requests to internal metadata addresses from the MarkLogic process.

2. Patch/upgrade steps

• Upgrade MarkLogic Server 12.x deployments to 12.1.0 or later, and 11.x deployments to 11.3.7 or later, per the vendor's stated fixed versions. Verify the running version after upgrade.
• Apply the upgrade in all environments including non-production, since test instances often carry production-like identities on Azure.
• No vendor patch has been confirmed by tracked patch sources (0/4); treat the fixed versions stated in the NVD description as the authoritative remediation target and validate against Progress advisories.

3. Long-term hardening

• Adopt a least-privilege model for all Azure managed identities attached to application hosts; never attach subscription-owner or contributor identities to internet-facing workloads.
• Implement egress filtering and metadata-endpoint protection across all cloud-hosted applications, not just MarkLogic.
• Add SSRF-specific destination allow-listing to application request libraries and centralize outbound request handling.
• Maintain inventory and version tracking for MarkLogic instances and Azure identities; continuously monitor for re-exposure after new deployments.
• Enable and retain cloud audit logs (Azure Activity Log, Entra ID sign-in logs) to spot token misuse post-exploitation.

References

1. NVD — CVE-2026-85951: https://nvd.nist.gov/vuln/detail/CVE-2026-85951
2. Progress MarkLogic Security Advisories: https://www.progress.com/marklogic (authoritative vendor advisory page)
3. MITRE CWE-918 — Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. Microsoft — Protect Azure Instance Metadata Service: https://learn.microsoft.com/azure/security/fundamentals/instance-metadata-service

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-85951 at this time; CISA KEV listing is not present.