CVE-2026-85954

Executive Summary

CVE-2026-85954 is a privilege escalation vulnerability in Progress MarkLogic Server affecting all 12.x releases before 12.1.0 and all 11.x releases before 11.3.7. The flaw allows user-controlled values passed to certain higher-order XQuery functions to be evaluated in an elevated security context, enabling an attacker to perform operations beyond their granted permissions. With a CVSS 3.1 base score of 8.6 (High) and a scope-changing vector, this is a network-reachable, unauthenticated-precondition flaw with high integrity impact on the vulnerable server.

Technical Analysis

MarkLogic Server is a multi-model NoSQL database platform built around XQuery, JavaScript, and REST-based access layers. Its security model assigns privileges and roles to users, and it provides evaluation primitives that execute expressions in a defined security context. Higher-order XQuery functions are those that accept other functions or expressions as values — they take a callback, a function item, or an expression argument and subsequently invoke or evaluate it internally.

The vulnerability arises because certain of these higher-order evaluation paths accept user-controlled values and evaluate them in a security context elevated above the caller's granted permissions. In practical terms, when application code or server infrastructure forwards attacker-influenced data into one of these higher-order evaluation functions, the server executes that data as though it held privileges the attacker does not legitimately possess. The privilege boundary is therefore crossed at the point of evaluation, not at the point of request authorization, which means normal access control checks applied to the original request do not prevent the escalation.

CWE-269 (Improper Privilege Management) correctly characterizes the root cause: the issue is not a memory-safety defect or an injection parser failure per se, but a failure to constrain the security context in which attacker-supplied values are evaluated. Because the CVSS vector reports Scope as Changed (S:C), the vulnerable component's evaluation context impacts resources beyond its own security authority — consistent with an elevation from the attacker's granted permission set to a broader role or privilege set on the server.

The NVD description does not name the specific higher-order XQuery functions involved, the API endpoints that expose them, or the exact roles required to reach the vulnerable code paths. Those implementation specifics are not available in the provided intelligence and are deliberately not stated here. What is derivable is the vulnerability class: a context/privilege-confusion flaw in a server-side query evaluation engine, reachable over the network with no authentication precondition stated (PR:N) and no user interaction required (UI:N).

Exploitation Scenarios

No public PoC or exploit code is available for this CVE, and no Nuclei template exists. The following attack chain is inferred from the vulnerability class (improper privilege management in a higher-order evaluation path) and the CVSS vector; it does not rely on any specific function name, endpoint, or parameter not present in the source description.

1. Reconnaissance and target identification. An attacker identifies an internet- or intranet-exposed MarkLogic Server instance running a vulnerable version line (11.x below 11.3.7 or 12.x below 12.1.0). Fingerprinting is feasible via HTTP response characteristics on the exposed database and administrative ports, version banners, or the REST/query interfaces that mark a MarkLogic deployment. The absence of a required privilege (PR:N) means the attacker's reconnaissance does not need to assume an existing low-privilege account for the class of attack to be viable.

2. Triggering the flaw class. The attacker supplies crafted input to an interface that ultimately passes a user-controlled value into a higher-order XQuery evaluation function. The defining characteristic is indirection: the attacker does not necessarily call the privileged operation directly; they feed data into an expression or function argument that the server subsequently evaluates. Because the evaluation occurs in an elevated security context, the server-side privilege check is satisfied at the evaluation layer even though the attacker's own permissions do not authorize the resulting action.

3. Payload/execution method at the vulnerability-class level. The payload is embedded in the user-controlled value handed to the higher-order function — for example, an expression or function reference that the server evaluates under privileges broader than the attacker's. No specific payload syntax, function name, or parameter is asserted here because the source description provides none. Success is measured by the server executing the value with privileges beyond the attacker's grant, not by a parser-level injection trick.

4. Post-exploitation impact. On success, the attacker operates with privileges above their granted level on the MarkLogic Server. Per the CVSS vector, integrity impact is High (I:H) while confidentiality and availability impacts are rated None (C:N/A:N) in the base vector, meaning the scored concern is unauthorized modification of data or configuration rather than direct data exfiltration or denial of service. With scope changed (S:C), the impact can extend to resources and trust boundaries beyond the vulnerable component — for example, administrative or system-level operations reached through the elevated context. Realistic downstream effects include unauthorized writes to database content, manipulation of documents, or alteration of server-side configuration, depending on the privileges reachable through the elevated evaluation.

Impact Assessment

The CVSS 3.1 base score is 8.6 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. Decomposed:

• Attack Vector Network (AV:N): the flaw is exploitable remotely over the network, not limited to local access.
• Attack Complexity Low (AC:L): no special conditions or race windows are described; the evaluation behavior is deterministic given the right input path.
• Privileges Required None (PR:N): exploitation does not require prior authentication as a legitimate user of the target service.
• User Interaction None (UI:N): no victim must click or approve anything.
• Scope Changed (S:C): the security authority impacted extends beyond the vulnerable component, elevating the blast radius.
• Integrity High (I:H): the primary impact is unauthorized modification of data or evaluation outcomes.
• Confidentiality None (C:N) and Availability None (A:N): the base vector does not score direct data disclosure or service disruption.

Affected systems. All Progress MarkLogic Server 11.x releases before 11.3.7 and all 12.x releases before 12.1.0. Enterprise deployments that expose MarkLogic query/REST interfaces to application tiers or untrusted networks face the highest exposure. Because PR:N is scored, deployments should not assume that an authenticated-user requirement limits reachability.

Blast radius. The change of scope means a successful exploit can affect resources and trust boundaries beyond the immediately vulnerable component. In a MarkLogic deployment, that can translate to unauthorized data modification at the database and configuration level, undermining the integrity guarantees that application teams and auditors rely on. CISA KEV status is NO and no exploit code or PoC is public, which lowers the immediate likelihood of mass exploitation while leaving the inherent risk of an unpatched, network-reachable privilege escalation in place.

Detection Guidance

Sigma Rule

title: Potential MarkLogic Higher-Order XQuery Privilege Escalation (CVE-2026-85954)
id: 4b2a7d1e-9c33-4f5a-b1e8-0d6f2c7a9e54
status: experimental
description: Detects suspicious use of higher-order XQuery evaluation paths on MarkLogic Server that may indicate attempted privilege escalation via CVE-2026-85954.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85954
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1068
  - attack.privilege_escalation
logsource:
  product: marklogic
  service: audit
detection:
  selection_event:
    event.action:
      - 'eval'
      - 'invoke'
      - 'xquery-eval'
      - 'function-apply'
  selection_context:
    marklogic.security_context|contains:
      - 'elevated'
      - 'admin'
      - 'system'
  selection_anomaly:
    user.privilege: 'low'
    resulting_privilege: 'elevated'
  condition: selection_event and (selection_context or selection_anomaly)
falsepositives:
  - Legitimate administrative query execution
  - Application code performing intended elevated evaluations
level: high

YARA Rule

rule CVE_2026_85954_MarkLogic_PrivEsc
{
    meta:
        description = "Detects MarkLogic XQuery content referencing higher-order evaluation patterns associated with CVE-2026-85954"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85954"
        date = "2026-01-01"
        severity = "high"

    strings:
        $xq1 = "eval(" ascii nocase
        $xq2 = "xquery:eval" ascii nocase
        $xq3 = "function-lookup" ascii nocase
        $xq4 = "function:apply" ascii nocase
        $xq5 = "xdmp:eval" ascii nocase

    condition:
        any of ($xq*)
}

Suricata IDS Rule

alert tcp any any -> any [8000,8001,8002,8010,8011] (msg:"CVE-2026-85954 Possible MarkLogic Higher-Order XQuery Privilege Escalation Attempt"; flow:established,to_server; content:"POST"; http_method; content:"eval"; http_uri; nocase; content:"xquery"; http_header; nocase; reference:cve,2026-85954; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85954; classtype:attempted-admin; sid:9000054; rev:1;)

Elastic Detection

sequence by host.id, user.name with maxspan=5m
  [ process where event.type == "start" and
      process.name in ("java","marklogic") and
      process.args : "*MarkLogic*" ]
  [ network where event.category == "network" and
      destination.port in (8000, 8001, 8002, 8010, 8011) and
      network.protocol == "http" and
      http.request.method == "POST" and
      http.request.body.content : "*eval*" ]

Splunk SPL Query

index=marklogic_logs OR index=web
| search (uri="*eval*" OR uri="*xquery*" OR body="*function-apply*")
| eval suspicious=if(match(_raw,"(?i)(xquery:eval|xdmp:eval|function:apply|function-lookup)"),1,0)
| where suspicious=1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85954,">
  <rule id="100954" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">eval|invoke|xquery-eval|function-apply</field>
    <field name="marklogic.security_context">elevated|admin|system</field>
    <description>CVE-2026-85954: Possible MarkLogic higher-order XQuery evaluation in elevated security context - privilege escalation attempt</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
  <rule id="100955" level="10">
    <decoded_as>json</decoded_as>
    <field name="user.privilege">low</field>
    <field name="resulting_privilege">elevated</field>
    <description>CVE-2026-85954: MarkLogic privilege context mismatch detected for low-privileged user</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence available from any tracked source). No vendor fix, workaround, or affected-version list was supplied in the tracked sources beyond the version thresholds in the NVD description.

1. Immediate mitigations

• Restrict network exposure of MarkLogic query, REST, and administrative ports. Do not expose MarkLogic evaluation interfaces to untrusted networks; place them behind authentication-aware proxies, network segmentation, and allowlists.
• Enforce least privilege on all MarkLogic roles and users. Audit role grants and remove unnecessary elevated privileges so that even a successful context confusion yields minimal additional authority.
• Audit and constrain application code that passes user-controlled input into higher-order evaluation functions. Where an application forwards untrusted data into an evaluation primitive, apply strict input validation and never forward raw user input into evaluation paths.
• Enable and forward MarkLogic audit logs (authentication, query evaluation, and privilege-change events) to the SIEM and alert on the detections above.
• Increase monitoring on the elevated-context evaluation events defined in the detection guidance, particularly when initiated by low-privileged users.

2. Patch/upgrade steps

• Upgrade MarkLogic Server 11.x deployments to 11.3.7 or later, and 12.x deployments to 12.1.0 or later, as indicated by the version thresholds in the NVD description.
• If an upgrade cannot be performed immediately, treat the deployment as unpatched: apply the network-exposure and least-privilege mitigations above and monitor continuously.
• Verify the vendor advisory for the authoritative fixed-version list and any additional workarounds; no vendor fix was confirmed in the tracked sources at time of publication.

3. Long-term hardening

• Establish a patch management cadence that tracks Progress MarkLogic security advisories and applies fixes promptly.
• Maintain an inventory of all MarkLogic instances and their exact version levels to identify vulnerable deployments quickly.
• Adopt a policy that user-controlled data never reaches server-side evaluation primitives without sanitization and context restriction.
• Periodically review role and privilege assignments against a formal least-privilege model, and test that privilege boundaries are enforced at the evaluation layer, not only at the request layer.
• Include scope-changing privilege escalation cases in purple-team exercises and validate detection coverage for T1068 against the MarkLogic log sources.

References

• NVD — CVE-2026-85954: https://nvd.nist.gov/vuln/detail/CVE-2026-85954
• CWE-269 Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• Progress MarkLogic Server product security advisories: https://www.progress.com/marklogic (vendor security advisory portal; confirm the fixed-version notice for CVE-2026-85954)
• MITRE ATT&CK T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• CVSS 3.1 Specification (scope-changed scoring semantics): https://www.first.org/cvss/v3.1/specification-document

Threat actor campaigns / exploit-in-the-wild. No exploit code, PoC, or Nuclei template is public for this CVE. CISA KEV status is NO, and EPSS has not yet been scored by FIRST.org. There is no evidence of active exploitation or named threat-actor campaign associated with CVE-2026-85954 at the time of publication.