CVE-2026-85957

Executive Summary

CVE-2026-85957 is an XML External Entity (XXE) vulnerability (CWE-611) in Progress MarkLogic Server 11.x releases prior to 11.3.7. The affected SAML parser configuration processes external DTDs or entities, allowing a remote, unauthenticated attacker to trigger unintended network access or information disclosure. With a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), the flaw exposes confidentiality of data reachable by the server but does not directly permit integrity or availability impact.

Technical Analysis

The vulnerability resides in the SAML processing path of MarkLogic Server. SAML assertions and metadata are XML documents, and the server's parser is configured in a way that honors external Document Type Definitions (DTDs) and external entity declarations. Under CWE-611 (Improper Restriction of XML External Entity Reference), this means that when the server parses attacker-supplied XML, it may resolve external entities rather than treating them as inert text.

Two primary mechanisms are relevant to this class:

1. External entity expansion — An attacker embeds a DOCTYPE declaration that defines an entity whose SYSTEM identifier points to a local file (e.g., file:///...) or a network resource. If the parser resolves it and reflects the value back in an error message, response body, or downstream log, file content can be disclosed to the attacker.
2. External DTD retrieval / SSRF-style network access — If the parser fetches external DTDs, the attacker can direct the server to make outbound requests to arbitrary hosts. This yields "unintended network access," which can be used for internal service enumeration, cloud metadata endpoint probing, or reaching systems otherwise shielded from the internet.

The NVD description explicitly states that the configuration "can process external DTDs or entities, which could result in unintended network access or information disclosure." It does not name specific parser classes, endpoints, or functions, so no code-level identifiers are asserted here. The attack surface is the SAML ingestion interface — the point at which MarkLogic accepts SAML assertions or metadata for authentication/federation purposes. Because the CVSS vector is PR:N/UI:N, no authentication or user interaction is required to attempt the attack; the attacker only needs network reachability to the relevant SAML endpoint.

The scope is unchanged (S:U), meaning impact is confined to the vulnerable component's security authority. Confidentiality impact is high (C:H) because the parser can be coerced into returning data the attacker should not see; integrity and availability are not impacted (I:N/A:N).

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE. The attack chain below is inferred strictly from the vulnerability class (CWE-611) and the NVD description; it contains no fabricated endpoint, parameter, or function names.

1. Reconnaissance / target identification. An attacker identifies internet- or intranet-exposed MarkLogic Server instances running 11.x below 11.3.7 — for example via fingerprinting responses and product banners. The presence of SAML-based federation or SSO integration is the key precondition, since the vulnerable behavior is in the SAML parser configuration.

2. Triggering the flaw class. The attacker submits a crafted XML SAML document (assertion or metadata) containing a DOCTYPE declaration that references external DTDs or external entities. Because the parser is configured to process external DTDs/entities, it attempts resolution of the attacker-controlled references rather than rejecting them.

3. Payload / execution method (class level). Two exploitation paths follow:

   • Information disclosure: the external entity is pointed at a local resource or internal URL, and the resolved content is surfaced — typically through an error message, echoed response, or log entry that the attacker can observe.
   • Network access (SSRF-style): the external DTD reference causes the server itself to issue an outbound request to an attacker-chosen destination. This can be used to probe internal networks, enumerate internal services, or reach metadata services reachable only from the server's network segment. No specific URI scheme or endpoint names are documented in the available data.

4. Post-exploitation impact. Successful exploitation yields high confidentiality impact — potentially reading configuration data, credentials, or responses from internal-only services. The flaw does not by itself grant code execution, data modification, or denial of service (I:N, A:N). However, disclosed information or enumerated internal services are frequently chained into follow-on attacks (e.g., credential reuse, lateral movement) once an initial foothold in the network is obtained.

Impact Assessment

• Confidentiality (High): The parser can be induced to disclose file contents or internal network responses.
• Integrity (None) / Availability (None): No write or disruption primitive is described.
• Attack Vector (Network) / Complexity (Low) / Privileges (None) / User Interaction (None): Exploitation is remote, repeatable, and requires neither credentials nor victim action, lowering the barrier to abuse.
• Blast radius: Any organization running MarkLogic Server 11.x prior to 11.3.7 with SAML processing enabled. Severity increases where instances are internet-exposed or sit adjacent to sensitive internal networks, cloud metadata services, or identity infrastructure — because the server's own network position grants the attacker the server's reach.
• Business impact: Potential exposure of internal configuration, secrets, or sensitive documents; internal network reconnaissance enabling later-stage intrusions; and compliance implications where a data disclosure occurs.

Detection Guidance

Sigma Rule

title: Potential XXE in MarkLogic SAML Parser (CVE-2026-85957)
id: 3f9c1b7e-8595-46c1-9a2e-7d0b1c4e8595
status: experimental
description: Detects SAML/XML requests containing DOCTYPE declarations with external entity or DTD references, indicative of XXE attempts against MarkLogic SAML processing.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85957
author: valtersit.com
logsource:
  category: webserver
detection:
  keywords_doctype:
    - 'DOCTYPE'
    - 'SYSTEM'
    - 'PUBLIC'
  keywords_entity:
    - '<!ENTITY'
    - 'file://'
    - 'http://'
  condition: keywords_doctype and keywords_entity
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate SAML metadata that includes external DTD references
level: high
tags:
  - attack.t1190
  - cve.2026.85957

YARA Rule

rule CVE_2026_85957_MarkLogic_SAML_XXE
{
    meta:
        description = "Detects XXE payloads targeting MarkLogic SAML parser configuration (CVE-2026-85957)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85957"
        date = "2026-01-01"
        severity = "high"

    strings:
        $doctype  = "DOCTYPE" nocase
        $entity   = "<!ENTITY" nocase
        $system   = "SYSTEM" nocase
        $public   = "PUBLIC" nocase
        $scheme_f = "file://" nocase
        $scheme_h = "http://" nocase
        $saml     = "SAML" nocase
        $assertion = "Assertion" nocase

    condition:
        uint32be(0) == 0x3C3F786D or $saml or $assertion
        and $doctype
        and $entity
        and ($system or $public)
        and ($scheme_f or $scheme_h)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85957 Possible XXE against MarkLogic SAML Parser"; flow:established,to_server; http.request_body; content:"DOCTYPE"; nocase; http.request_body; content:"<!ENTITY"; nocase; http.request_body; content:"SYSTEM"; nocase; http.request_body; pcre:"/(file|http|https|ftp):\/\//i"; reference:cve,2026-85957; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85957; classtype:attempted-recon; sid:202685957; rev:1;)

Elastic Detection

sequence by source.ip, destination.port with maxspan=5s
  [http where http.request.method in ("POST", "PUT") and
   wildcard(http.request.body, "*DOCTYPE*") and
   wildcard(http.request.body, "*<!ENTITY*")]

Detection note: match on HTTP request bodies containing a DOCTYPE plus entity declaration, correlated to the MarkLogic SAML endpoint. If request bodies are not captured, fall back to URL path and user-agent anomalies combined with response error patterns.

Splunk SPL Query

index=web OR index=marklogic
| eval body=coalesce(http_request_body, request_body, uri_query, "")
| where match(body, "(?i)<!DOCTYPE") AND match(body, "(?i)<!ENTITY") AND match(body, "(?i)(SYSTEM|PUBLIC)")
| eval xxe_indicator=if(match(body, "(?i)(file|http|https|ftp)://"), "external_ref", "doctype_only")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, dest_port, xxe_indicator, uri_path
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,marklogic,xxe,">
  <rule id="2026857" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.request.body">\.<!DOCTYPE</field>
    <description>CVE-2026-85957: Possible XXE payload with DOCTYPE in HTTP request body targeting MarkLogic SAML parser.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="2026858" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.request.body">\.<!ENTITY</field>
    <description>CVE-2026-85957: Possible external entity declaration in HTTP request body targeting MarkLogic SAML parser.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence, vendor advisory, or workaround was confirmed from any tracked source in the provided data. Treat remediation as inference-driven.

1. Immediate mitigations

   • Restrict network access to MarkLogic Server instances and, in particular, to any SAML assertion-consumption or federation endpoints. Place them behind authentication-aware reverse proxies and IP allowlists where federation partners are known.
   • Where possible, disable or avoid SAML-based federation until the server can be upgraded, if the deployment allows.
   • Harden the XML parsing layer at the environment/junior-config level: ensure that any XML/SAML parser used in the request path disables external DTD loading and external entity resolution. This is a configuration change independent of the product version, but it must be verified against the vendor's documented configuration surface — no configuration keys are confirmed in the data provided.
   • Egress-filter outbound traffic from the MarkLogic host so that, even if the parser attempts external retrieval, it cannot reach arbitrary internal or cloud metadata destinations.
   • Monitor and alert on the detector signals above; treat any XXE-shaped request to SAML paths as a security incident.

2. Patch / upgrade steps

   • According to the NVD description, affected releases are Progress MarkLogic Server 11.x prior to 11.3.7. Upgrade to 11.3.7 or later once a vendor-confirmed build is available. Validate the upgrade artifact against Progress's official release channel and checksums before deployment.
   • Because no vendor advisory URL was provided, confirm the fixed version directly with Progress support or the official MarkLogic download portal prior to scheduling maintenance.

3. Long-term hardening

   • Enforce a global parser policy that disallows DTDs and external entities for all XML ingestion (a standard XXE hardening posture).
   • Segment MarkLogic hosts from sensitive internal networks and cloud metadata services to shrink the reachable blast radius of any SSRF-style primitive.
   • Deploy an XML/SAML-aware WAF or API gateway that rejects DOCTYPE and external entity declarations at the edge.
   • Track CVE-2026-85957 and subscribe to Progress security bulletins to obtain the vendor patch the moment it is published.

References

• NVD — CVE-2026-85957: https://nvd.nist.gov/vuln/detail/CVE-2026-85957
• MITRE CWE-611 — Improper Restriction of XML External Entity Reference: https://cwe.mitre.org/data/definitions/611.html
• OWASP — XML External Entity (XXE) Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
• Progress MarkLogic Server product/security information: https://www.progress.com/marklogic
• CISA Known Exploited Vulnerabilities Catalog (check for future inclusion): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or in-the-wild exploitation evidence is currently available for CVE-2026-85957, and there is no indication of CISA KEV listing or known threat-actor campaign activity tied to this CVE as of the data provided.