CVE-2026-85964

Executive Summary

CVE-2026-85964 is an authenticated path traversal vulnerability (CWE-22) in Progress MarkLogic Server that allows a user with access to the Query Console to pass unsafe path values to a privileged filesystem helper. Successful exploitation results in the disclosure of arbitrary files from the server filesystem that the helper process can reach.

All MarkLogic 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. Because the vulnerability crosses a privilege boundary (CVSS scope is marked Changed) and exposes high-confidentiality data to a merely authenticated user, it represents a significant risk to enterprises that run multi-tenant or shared MarkLogic clusters, or that grant Query Console access to any non-administrative principal.

Technical Analysis

MarkLogic Server exposes a browser-based Query Console on its administrative application server (commonly on port 8000). Query Console lets authenticated users compose and execute XQuery, JavaScript, and SPARQL against databases and, critically, allows invocation of server-side functions that have file and module access on the underlying operating system.

The vulnerability class here is path traversal: an authenticated Query Console user can supply path values that are not adequately validated before they are handed to a privileged filesystem helper. Rather than constraining the resolved path to an intended sandbox or working directory, the helper accepts attacker-controlled traversal sequences (for example ../ style segments) and resolves them outside the intended location. This permits reading of arbitrary files that the helper's operating-system identity is permitted to access.

Key characteristics of this issue, derived strictly from the available description:

• Authentication required, privilege not: The attacker must be an authenticated Query Console user, but need not hold administrative privileges. The PR:L (Low privileges) CVSS metric reflects this — the entry condition is low, while the resulting access is high impact.
• Scope change: The S:C metric indicates the vulnerable component's security authority is exceeded; the filesystem helper operates with privileges and reach beyond those of the invoking user, so the compromise crosses a trust boundary.
• Confidentiality only: The vector shows C:H/I:N/A:N — impact is limited to information disclosure. There is no described integrity or availability impact; the flaw does not, per the description, permit file writes or denial of service.
• Network attack vector: AV:N confirms the vector is reachable over the network via the Query Console interface.

The description explicitly references "a privileged filesystem helper." No specific function names, module paths, API endpoints, or parameter names are provided in the NVD description, and none are invented here. The defect is best characterized as a missing or insufficient canonicalization/allow-listing step on a path argument prior to a privileged file read operation, allowing traversal outside the intended directory. The exact helper interface and the parameter supplied by the Query Console user are not disclosed in the available intelligence.

Because the vulnerability requires only an authenticated Query Console session, the practical attack surface is the Query Console application server. Any deployment where Query Console is reachable by users beyond a tightly controlled administrative group is exposed to the second stage of the exploit.

Exploitation Scenarios

No public proof-of-concept is available. The attack chain below is inferred at the vulnerability-class level from the NVD description; concrete implementation details (function names, parameters, endpoints) are not disclosed and are not fabricated.

1. Reconnaissance / target identification. An adversary identifies an internet- or intranet-reachable MarkLogic Server administrative interface. Enumeration can focus on hosts exposing the administrative application server port (default 8000) and presenting Query Console. Shodan-style queries for MarkLogic product banners or Query Console titles assist in locating candidate hosts. The attacker then verifies that Query Console is reachable and authenticated access is obtainable (legitimate low-privileged account, leaked/weak credential, or a separate account-compromise path).

2. Triggering the flaw class. Once authenticated to Query Console, the attacker submits a request that invokes the privileged filesystem helper while supplying a crafted path value containing directory traversal sequences. The helper, lacking adequate validation, resolves the path outside the intended directory. This is the core path traversal trigger (CWE-22).

3. Payload / execution method (vulnerability-class level). The "payload" is a path string that escapes the intended root — e.g., traversal segments that walk up out of the constrained directory and then reference a target file. Because the NVD description does not disclose the parameter name or the helper's interface, no specific query syntax or function call is presented. The essential element is delivery of a traversal-bearing path through the authenticated Query Console execution channel.

4. Post-exploitation impact. The privileged helper returns the contents of the targeted file to the requester, disclosing arbitrary server files the helper's identity can read. At the information-disclosure level this can include configuration, credential, and security-relevant files reachable by that process. The attacker may then use disclosed material for lateral movement or escalation within the environment. There is no described integrity or availability impact.

Confidence in this chain is based solely on the described flaw class and CVSS metrics; it should be validated against the vendor advisory and a controlled test environment before operational reliance.

Impact Assessment

The CVSS 3.1 base score is 7.7 (High), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.

• Attack Vector (Network): Exploitable remotely over the network through Query Console.
• Attack Complexity (Low): No special conditions or race windows are described; a straightforward traversal request is sufficient.
• Privileges Required (Low): Only an authenticated Query Console user is needed — not an administrator.
• User Interaction (None): No victim interaction is required once the attacker has a session.
• Scope (Changed): The vulnerable helper's authority exceeds that of the invoking user, so the security scope of the vulnerable component is breached.
• Confidentiality (High): Arbitrary server file disclosure, potentially including sensitive configuration and credential material.
• Integrity (None) / Availability (None): No described write or disruption impact.

Business impact: Organizations running shared or multi-user MarkLogic deployments, or exposing Query Console to non-administrative personnel, face potential disclosure of sensitive server-side files. Because integrity and availability are unaffected, the primary risk is data exposure and downstream credential/systems compromise rather than service disruption.

Blast radius: Any MarkLogic Server 12.x release before 12.1.0 and 11.x release before 11.3.7. The breadth of disclosure depends on the filesystem permissions of the privileged helper — the more privileged that identity, the larger the potential file exposure.

Detection Guidance

Detection should focus on anomalous Query Console activity by low-privileged users and on traversal-bearing path strings crossing the application server. Because no PoC or exploit code exists publicly, detections are behavioral and vulnerability-class oriented.

Sigma Rule

title: MarkLogic Query Console Path Traversal File Disclosure Attempt (CVE-2026-85964)
id: 3f6d9c2e-8596-4c1a-9b7e-marklogic85964
status: experimental
description: Detects requests to MarkLogic Server Query Console containing directory traversal sequences, indicating attempts to exploit CVE-2026-85964.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85964
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: marklogic
detection:
  selection_uri:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%252f'
      - '%2e%2e%2f'
      - '%2e%2e/'
  selection_host:
    cs-host|contains: 'marklogic'
  condition: selection_uri and selection_host
fields:
  - c-ip
  - cs-username
  - cs-uri-query
falsepositives:
  - Legitimate administrative maintenance queries referencing relative paths
level: high

YARA Rule

rule CVE_2026_85964_MarkLogic_Traversal_Request
{
    meta:
        description = "Detects HTTP request artifacts containing path traversal sequences targeting MarkLogic Query Console (CVE-2026-85964)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85964"
        date = "2026-01-01"
        severity = "high"

    strings:
        $traversal1 = "../" ascii nocase
        $traversal2 = "..%2f" ascii nocase
        $traversal3 = "..%252f" ascii nocase
        $traversal4 = "%2e%2e%2f" ascii nocase
        $ml = "MarkLogic" ascii nocase
        $qc = "Query Console" ascii nocase

    condition:
        any of ($traversal*) and any of ($ml, $qc)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85964 MarkLogic Query Console Path Traversal Attempt"; flow:established,to_server; http.host; content:"marklogic"; nocase; http.uri; content:"Query Console"; nocase; http.uri; pcre:"/(\.\.\/|\.\.%2f|%2e%2e%2f|\.\.%252f)/i"; threshold: type both, track by_src, count 5, seconds 60; reference:cve,2026-85964; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85964; classtype:attempted-recon; sid:202685964; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "POST"
     and url.path contains "Query Console"
     and http.request.body contains "../"]
  [network where http.request.method == "POST"
     and url.path contains "Query Console"
     and http.response.status_code == 200]

Splunk SPL Query

index=web OR index=marklogic sourcetype=access_combined OR sourcetype=marklogic_audit
| eval uri=urldecode(uri_query)
| where match(uri, "(?i)(\.\./|\.\.%2f|%2e%2e%2f|\.\.%252f)")
| where match(uri, "(?i)(query.?console|marklogic)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as paths by src_ip, user
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,marklogic,cve-2026-85964">
  <rule id="10085964" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>Query Console</url>
    <regex type="pcre2">(?i)(\.\./|\.\.%2f|%2e%2e%2f|\.\.%252f)</regex>
    <description>CVE-2026-85964: Possible MarkLogic Query Console path traversal file disclosure attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85964,path_traversal,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor advisory indicates remediation through upgrade, but no patch artifacts have been confirmed by our tracked sources; treat as unpatched until verified.

1. Immediate mitigations

   • Restrict network access to the MarkLogic administrative application server (Query Console) to trusted administrative networks only. Do not expose it to the public internet or broad internal ranges.
   • Enforce least privilege: audit accounts with Query Console access and remove it from any user who does not require it. Treat Query Console access as a privileged capability.
   • Where feasible, run the privileged filesystem helper's host process under a constrained operating-system identity to limit the set of readable files.
   • Monitor for traversal-bearing path values reaching Query Console (see Detection Guidance).

2. Patch / upgrade steps

   • Plan migration to MarkLogic Server 12.1.0 or later for 12.x deployments, or 11.3.7 or later for 11.x deployments, per the advisory-fixed versions. Validate in a staging environment before production rollout.
   • Verify the fixed build once patches are formally published by Progress and confirm against the vendor advisory/changelog.
   • Re-validate Query Console access controls post-upgrade.

3. Long-term hardening

   • Apply allow-listing and canonicalization to all user-supplied paths before privileged filesystem operations; reject traversal segments explicitly.
   • Segment management interfaces from data planes and enforce strong administrative authentication and MFA.
   • Maintain a software inventory for MarkLogic deployments to rapidly correlate future advisories, and subscribe to vendor security bulletins.
   • Adopt periodic review of low-privileged users who nonetheless hold access to powerful consoles.

References

• NVD — CVE-2026-85964: https://nvd.nist.gov/vuln/detail/CVE-2026-85964
• Progress MarkLogic Server security advisories: https://www.progress.com/marklogic (vendor advisory channel — confirm the specific CVE-2026-85964 advisory)
• MITRE CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Note: CVE-2026-85964 is not listed in CISA KEV. No public PoC, exploit code, or Nuclei template is known at the time of writing. No EPSS score was available; no value is estimated. No threat actor campaigns or in-the-wild exploitation evidence are currently attributed to this CVE based on the provided data.