CVE-2026-85955

Executive Summary

CVE-2026-85955 is a privilege-escalation flaw in Progress MarkLogic Server affecting all 12.x releases before 12.1.0 and all 11.x releases before 11.3.7. A remote attacker who already possesses query-execution access can invoke an XQuery evaluation function that lacks the additional evaluation-privilege check, allowing server-side code execution with elevated permissions. Because the flaw is remotely reachable with low attack complexity, requires only low privileges, and results in a scope change with high confidentiality, integrity, and availability impact, it carries a CVSS v3.1 base score of 9.9 (Critical). No public proof-of-concept, exploit code, or Nuclei template is presently available, and the vulnerability is not listed in CISA KEV.

Technical Analysis

The core weakness is mapped to CWE-269 (Improper Privilege Management). In affected MarkLogic Server builds, an attacker holding query-execution rights can reach an XQuery evaluation function that is not gated by the "additional required evaluation privilege." In other words, the authorization control that should be enforced before dynamic evaluation occurs is missing or insufficient at that call path.

MarkLogic is a multi-model database whose application tier exposes query execution to authenticated/authorized users, commonly over its application services ports (default 8000 for the app server, 8001 for the admin interface, and 8002 for manage on standard deployments — operators should confirm their own configuration). The attack surface here is any interface where a user with query-execution access can submit XQuery. The privilege boundary that fails is the separation between "can run a query" and "can run an evaluation primitive that executes code with elevated/database-server privileges."

The result is server-side code execution under elevated permissions. Because the CVSS vector's Scope is marked Changed (S:C), the impact crosses an authorization boundary — code executed via the abused evaluation function can affect resources beyond the attacker's originally granted privilege set. The NVD description does not name the specific function, so this report does not attribute a function or parameter name beyond "an XQuery evaluation function" as stated.

The vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates: network-reachable, no special conditions, low privileges required (authenticated query-execution access), no user interaction, changed scope, and full high impact across C/I/A. Note the PR:L rating — this is not fully unauthenticated; the attacker must already have query-execution access, which raises the bar slightly relative to a pure pre-auth bug but does not reduce the severity once such access exists (e.g., a low-privileged application account, a compromised integration, or a multi-tenant deployment).

No patch artifacts, workarounds, OSV package mappings, or vendor-fix references were returned by tracking sources at time of writing; affected-version data is derived solely from the CNA/NVD description.

Exploitation Scenarios

No public PoC is available; the chain below is inferred from the vulnerability class (improper privilege management in an XQuery evaluation path) and constrained to names appearing in the NVD description.

1. Reconnaissance / target identification: Identify externally reachable MarkLogic application servers. Shodan and similar services can fingerprint MarkLogic by product banner, HTTP title, and TLS certificate subject. The attacker establishes which deployments run 12.x (< 12.1.0) or 11.x (< 11.3.7).

2. Access acquisition: The attacker must first obtain query-execution access. This is the PR:L precondition — for example, a legitimately provisioned but low-privileged account, a credential from an unrelated compromise, or access granted to an integration/service account. This CVE is therefore most dangerous as a post-foothold escalation primitive rather than a zero-credential entry point.

3. Triggering the flaw: With query-execution access, the attacker submits a query that invokes the XQuery evaluation function referenced in the description. Because the additional evaluation privilege is not enforced on that call path, the request is processed rather than denied.

4. Execution and impact: The evaluation runs server-side with elevated permissions, yielding code execution beyond the attacker's intended privilege level (scope change). Post-exploitation, an attacker could read or modify database content (high integrity/confidentiality impact) and disrupt availability (high A impact), consistent with the H/H/H subscores.

Caveats: the specific function name, exact request syntax, and any required role binding are not disclosed in the provided data and are deliberately not fabricated here. Whether the flaw also permits a jump from unauthenticated to authenticated is not supported by the CVSS vector (PR:L), so such claims should not be made.

Impact Assessment

• Attack Vector (AV:N): exploitable across the network — no local access required.
• Attack Complexity (AC:L): no race conditions or special conditions; reliably exploitable once the prerequisite access exists.
• Privileges Required (PR:L): requires low-privileged query-execution access.
• User Interaction (UI:N): no victim action needed.
• Scope (S:C): the compromised component affects resources beyond its authorization boundary — privilege escalation, not merely data exposure.
• Confidentiality/Integrity/Availability (C:H/I:H/A:H): full impact on all three.

Business impact: MarkLogic commonly stores regulated, mission-critical, or sensitive enterprise data. Successful exploitation is equivalent to arbitrary server-side code execution at elevated privilege, enabling data exfiltration, tampering, persistence, and denial of service. Blast radius includes any application, integration, or tenant served by the affected MarkLogic deployment, and—given scope change—potentially the host and adjacent services. Multi-tenant or shared-integration deployments amplify risk because the low-privilege precondition may already be satisfied for many accounts. CVSS base: 9.9 Critical. EPSS has not yet been scored by FIRST.org; no EPSS value is asserted here. Not listed in CISA KEV; no observed exploitation confirmed.

Detection Guidance

Sigma Rule

title: Potential MarkLogic XQuery Evaluation Privilege Abuse (CVE-2026-85955)
id: 5f2c8d1a-9b47-4e21-8c6a-mlxcve202685955
status: experimental
description: Detects MarkLogic query-execution requests invoking an XQuery evaluation function without the required evaluation privilege
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85955
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: marklogic
detection:
  selection_method:
    cs-method: 'POST'
  selection_eval:
    cs-uri-query|contains:
      - 'eval'
      - 'xquery'
      - 'invoke'
  selection_status:
    sc-status:
      - 200
      - 500
  condition: selection_method and selection_eval and selection_status
falsepositives:
  - Legitimate application queries that reference evaluation functionality
  - Administrative query testing
level: high
tags:
  - attack.t1190
  - cve.2026.85955

YARA Rule

rule CVE_2026_85955_MarkLogic_XQuery_PrivEsc
{
    meta:
        description = "Detects references to MarkLogic XQuery evaluation privilege abuse (CVE-2026-85955)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85955"
        date = "2026-01-01"
    strings:
        $ml1 = "MarkLogic" ascii nocase
        $eval1 = "xquery" ascii nocase
        $eval2 = "eval" ascii nocase
        $priv = "evaluation privilege" ascii nocase
        $ver1 = "12.1.0" ascii
        $ver2 = "11.3.7" ascii
    condition:
        filesize < 5MB and
        (
            ($ml1 and $eval1 and $eval2) or
            ($ml1 and $priv)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85955 MarkLogic XQuery Evaluation Privilege Abuse Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"xquery"; nocase; http.uri; content:"eval"; nocase; classtype:attempted-admin; reference:cve,2026-85955; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85955; sid:2026859550; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where network.protocol == "http" and http.request.method == "POST"]
  [network where network.protocol == "http" and
     (url.query : "eval" or url.query : "xquery" or url.path : "eval") and
     url.port in (8000, 8001, 8002)]

Splunk SPL Query

index=web OR index=marklogic sourcetype=access_combined OR sourcetype=marklogic_request
| search (uri_path="*/eval*" OR uri_query="*xquery*" OR uri_query="*eval*")
| where status IN (200, 500)
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip, dest
| where count > 3
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85955,">
  <rule id="100955" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">xquery|eval</field>
    <field name="method">POST</field>
    <description>CVE-2026-85955: MarkLogic XQuery evaluation function invoked with query-execution privilege - possible privilege escalation.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (until a validated patch is applied):

• Restrict network exposure of MarkLogic application services; do not expose query-execution ports to untrusted networks. Enforce strict allowlisting at the perimeter and firewall.
• Enforce least privilege on all accounts that possess query execution: remove or downgrade unnecessary query-execution roles, and audit which principals currently hold them.
• Monitor and alert on invocation of XQuery evaluation functionality, as detailed in the Detection Guidance section.
• Where feasible, disable or tightly constrain ad hoc/dynamic evaluation paths for non-administrative principals using MarkLogic's authorization model.

2. Patch / upgrade steps:

• Upgrade to MarkLogic Server 12.1.0 (for 12.x) or 11.3.7 (for 11.x), the fixed versions identified in the advisory. Confirm the fixed version against the vendor's official advisory before deployment.
• Validate the upgrade in a non-production environment, verify that the evaluation-privilege enforcement is present, then roll out. Back up data and configuration before upgrading.
• Re-verify the privileged-code path after patching to confirm the additional evaluation privilege is enforced.

3. Long-term hardening:

• Adopt a formal privileged-access review cycle for query-execution roles.
• Segment database tiers from general-purpose networks; require authenticated, audited access.
• Deploy application-level input validation and standardized authorization checks on every evaluation-type endpoint.
• Track vendor advisories and CVE feeds for future MarkLogic releases; subscribe to the Progress security bulletin channel.

References

• NVD — CVE-2026-85955: https://nvd.nist.gov/vuln/detail/CVE-2026-85955
• Progress MarkLogic security advisories/bulletins (vendor security page): https://www.progress.com/security
• Progress MarkLogic Server product/versioning documentation (12.1.0 / 11.3.7 fixed releases): https://www.progress.com/marklogic
• MITRE CWE-269 (Improper Privilege Management): https://cwe.mitre.org/data/definitions/269.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/

Threat-actor/intel note: No exploit code, PoC, or Nuclei template is publicly available, and CVE-2026-85955 is not listed in CISA KEV. There is no confirmed evidence of in-the-wild exploitation or attribution to a named threat actor at time of writing.