CVE-2026-85962

Executive Summary

CVE-2026-85962 is an improper authentication vulnerability (CWE-287) in the SAML processing logic of Progress MarkLogic Server. MarkLogic 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected, but only in deployments configured to use SAML authentication. An unauthenticated remote attacker can cause the server to accept a SAML assertion that should have been rejected, which can result in unauthorized access to the MarkLogic instance and the data it stores.

Technical Analysis

The vulnerability resides in the SAML processing path of MarkLogic Server. SAML (Security Assertion Markup Language) is a standards-based federated authentication mechanism in which an identity provider (IdP) issues a signed assertion to a service provider (the MarkLogic server), which must then validate that assertion before establishing a session. Correct validation requires checking the assertion's digital signature, its issuer, audience, subject confirmation, conditions (NotBefore/NotOnOrAfter), and replay protections. CWE-287 (Improper Authentication) indicates that at least one of these validation steps is missing or insufficiently enforced, such that a crafted or manipulated assertion is accepted when it should be rejected.

The NVD description states the root cause is "an improper authentication vulnerability in SAML processing" and that the effect is that the server "accept[s] an assertion that should be rejected." The description does not disclose which specific validation check (signature verification, audience restriction, condition evaluation, or replay detection) is at fault, nor does it name internal functions, endpoints, or parameters. No specific code paths, classes, or configuration keys are identified in the supplied intelligence, so this report deliberately describes the vulnerability at the class level rather than fabricating implementation details.

Attack surface: the SAML assertion consumer / single sign-on endpoint exposed by MarkLogic when SAML authentication is enabled. This is network-reachable (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), and has high attack complexity rated low (AC:L), consistent with an attacker being able to craft and replay requests programmatically. The scope is unchanged (S:U) and there is no confidentiality subscore in the supplied vector (C:N), while integrity is rated High (I:H) and availability is not impacted (A:N). The I:H rating reflects that unauthorized access can alter or influence data and security decisions on the platform.

Because the flaw is in authentication, successful exploitation effectively collapses the trust boundary between anonymous network clients and authenticated MarkLogic principals. The impact is concentrated in confidentiality-adjacent and integrity-relevant outcomes: an attacker who obtains a session can act with the privileges associated with the identity the assertion maps to.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-85962 as of the supplied data. The attack chain below is inferred from the vulnerability class (CWE-287 in SAML processing) and the NVD description; it is not derived from a published exploit.

1. Reconnaissance / target identification. The attacker identifies internet- or network-reachable MarkLogic Server instances that have SAML authentication enabled. This is typically observable via the SAML SSO / assertion-consumer endpoint that becomes active when SAML is configured, or via response headers, error pages, or metadata that identify MarkLogic. Shodan-style pivots such as product and HTTP title/body matches can enumerate candidate hosts.

2. Triggering the flaw. Because the defect is in SAML assertion validation, the attacker interacts with the SAML endpoint directly rather than through a legitimate IdP flow. The attacker crafts a SAML assertion intended to be rejected, or manipulates one that the server fails to validate correctly. At the class level, the weakness is that a validation control does not fire — for example an assertion whose signature, issuer, audience, condition window, or replay state should cause rejection is instead accepted. The exact manipulated field is not disclosed in the available intelligence.

3. Execution / payload method. No payload details are specified in the NVD data. Generically, the "payload" is an HTTP request carrying a SAML response/assertion to the SAML processing endpoint; success is indicated by the server issuing an authenticated session rather than returning an authentication error.

4. Post-exploitation impact. On success, the attacker gains unauthorized access to the MarkLogic instance. Given the CVSS integrity rating of High, the attacker can be expected to perform operations permitted to the mapped identity — reading, modifying, or deleting content and configuration within the limits of that principal. This may include access to document stores, security configuration, and, if a highly privileged identity is assumed, administrative functionality.

Defenders should treat any successful authentication via SAML where the IdP did not issue the corresponding assertion, or repeated malformed/replayed assertions, as likely exploitation.

Impact Assessment

Business impact centers on the integrity and trustworthiness of data and access controls held in MarkLogic. Affected systems are specifically those MarkLogic Server deployments running 11.x before 11.3.7 or 12.x before 12.1.0 that are configured to authenticate users via SAML. Deployments not using SAML are not affected by this particular vector.

Blast radius depends on the privileges associated with the identity an accepted forged/misissued assertion maps to. If administrative roles are mapped from SAML attributes, an attacker could obtain administrative access to the cluster. CVSS subscores from the supplied vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) indicate a remotely exploitable, low-complexity attack requiring no authentication and no user interaction, with High integrity impact and no explicit availability impact. The base score is 7.5 (High). No EPSS score has been assigned by FIRST.org and the CVE is not listed in CISA KEV; there is currently no confirmed exploit-in-the-wild evidence.

Detection Guidance

Sigma Rule

title: Suspicious MarkLogic SAML Assertion Rejection Bypass Attempts
id: 8f2c1a44-9b7e-4e2a-8c11-4a5e9d7b6f31
status: experimental
description: Detects repeated or anomalous SAML assertion processing failures or successes on MarkLogic Server that may indicate exploitation of CVE-2026-85962.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85962
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: marklogic
  service: saml
detection:
  selection_error:
    event:
      - 'SAMLAssertionRejected'
      - 'SAMLValidationFailure'
      - 'SAMLError'
  selection_success:
    event:
      - 'SAMLLoginSuccess'
  filter_known_good:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_error or (selection_success and not filter_known_good)
falsepositives:
  - Legitimate SAML misconfiguration by administrators
  - Clock skew causing assertion condition failures
level: high

YARA Rule

rule CVE_2026_85962_SAML_Assertion_Replay_Artifacts
{
    meta:
        author = "Threat Intelligence"
        description = "Detects SAML assertion artifacts associated with potential CVE-2026-85962 exploitation in logs or captures"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85962"
        date = "2026-01-01"
        severity = "high"

    strings:
        $saml1 = "SAMLResponse" ascii nocase
        $saml2 = "Assertion" ascii nocase
        $saml3 = "NotOnOrAfter" ascii nocase
        $saml4 = "AudienceRestriction" ascii nocase
        $marklogic = "MarkLogic" ascii nocase

    condition:
        $marklogic and ($saml1 or $saml2) and ($saml3 or $saml4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85962 MarkLogic SAML Improper Authentication Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"SAML"; nocase; http.request_body; content:"SAMLResponse"; nocase; http.request_body; content:"Assertion"; nocase; threshold: type both, track by_src, count 10, seconds 60; classtype:attempted-admin; sid:202685962; rev:1; reference:cve,2026-85962; metadata: service http;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "POST" and
     url.path : "*SAML*" and
     http.request.body.text : "*SAMLResponse*"]
  [network where http.response.status_code == 200 and
     url.path : "*SAML*" and
     not source.ip : ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")]

Splunk SPL Query

index=web OR index=marklogic
| search (uri="*SAML*" OR url="*SAML*" OR uri_path="*SAML*")
| eval saml_indicator=if(match(_raw,"(?i)SAMLResponse|Assertion|NotOnOrAfter|AudienceRestriction"),1,0)
| where saml_indicator=1
| stats count values(status) as status_codes dc(uri) as unique_uris by src_ip
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="marklogic,saml,cve-2026-85962,">
  <rule id="100962" level="10">
    <decoded_as>json</decoded_as>
    <field name="event">SAMLAssertionRejected</field>
    <description>CVE-2026-85962: MarkLogic SAML assertion rejected - possible validation bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100963" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">SAMLLoginSuccess</field>
    <field name="srcip">\.+</field>
    <description>CVE-2026-85962: MarkLogic SAML login success from unexpected source - investigate possible forged assertion</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description identifies the fixed versions (12.1.0 for the 12.x line and 11.3.7 for the 11.x line), but no vendor advisory, hotfix, or workaround has been confirmed by tracked sources. Treat this as unpatched until the vendor publishes an advisory.

1. Immediate mitigations.

   • If SAML authentication is not operationally required, disable SAML in the MarkLogic configuration so the assertion-processing path is not exposed. This removes the attack vector documented for this CVE.
   • Restrict network access to the MarkLogic SAML endpoints using firewall rules and segmentation so only trusted IdP or reverse-proxy sources can reach them.
   • Enforce strict IdP-side validation: sign all assertions, restrict the audience and recipient to the specific MarkLogic service-provider entity, and reject unsigned or unsolicited responses at the IdP/proxy layer.
   • Enable verbose SAML auditing and monitor for assertions where the IdP has no corresponding issuance record.

2. Patch / upgrade steps.

   • Plan an upgrade to MarkLogic Server 12.1.0 (from 12.x) or 11.3.7 (from 11.x) as stated in the NVD description.
   • Verify the exact fix build against the vendor's official release notes before production rollout; no independent patch artifact is available in this dataset.
   • After upgrading, retest the SAML login flow end-to-end and re-confirm assertion validation behavior.

3. Long-term hardening.

   • Validate all SAML assertions strictly: require signature verification, enforce NotBefore/NotOnOrAfter conditions, check audience restriction, and implement replay protection (assertion ID caching).
   • Apply least privilege to SAML-to-role mappings so a compromised or forged assertion cannot map directly to administrative privileges.
   • Add continuous monitoring and alerting for anomalous SAML authentication events, and include MarkLogic in standard vulnerability-management scanning.
   • Maintain an inventory of authentication endpoints and periodically test federation configurations against known CWE-287 patterns.

References

• NVD — CVE-2026-85962: https://nvd.nist.gov/vuln/detail/CVE-2026-85962
• CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• Progress MarkLogic Server product documentation and security advisories: https://www.progress.com/marklogic
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85962 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns: none identified. No exploit-in-the-wild evidence, PoC, or KEV listing is available for CVE-2026-85962 at the time of writing.