CVE-2026-85970

Executive Summary

CVE-2026-85970 is an XML External Entity (XXE) injection vulnerability (CWE-611) affecting Progress MarkLogic Server. Per the NVD description, MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, allowing crafted XML to trigger server-side requests or disclosure of local files. The flaw is network-reachable and requires low privilege (CVSS:3.1 base 7.1, AV:N/AC:L/PR:L/UI:N), so any authenticated or minimally-privileged user able to submit XML to an affected endpoint can potentially exfiltrate local files or coerce the server into outbound requests. There is currently no public PoC, no Nuclei template, no vendor fix confirmation from tracked sources, and the CVE is not in CISA KEV.

Technical Analysis

The vulnerability class is XML External Entity injection (CWE-611). Under this class of flaw, an XML parser is configured — here, by default — to resolve external entities declared in a DTD referenced by attacker-supplied XML. When external entity resolution is enabled, the parser will dereference SYSTEM/PUBLIC entity declarations, which can point to:

• Local files using file:// URIs (local file disclosure).
• Remote resources using http://, https://, or other supported schemes (server-side request forgery).

Per the NVD description, the defect is that "XML external entity processing [is enabled] by default in multiple server paths." This means the vulnerable attack surface is not a single endpoint but a set of server paths that accept and parse XML. The description does not enumerate those paths, the relevant parser, or any class/function/parameter names, so no specific implementation detail can be stated without fabricating it. What can be stated precisely is the mechanism:

1. A request handler on an affected MarkLogic Server path ingests attacker-controlled XML.
2. The XML includes a DOCTYPE declaration defining an external entity whose value is a file:// or remote URI.
3. The parser, with external entity resolution left enabled by default, dereferences the entity.
4. The resolved value is either returned in the response, surfaced in an error message, embedded in a stored document, or fetched outbound — yielding file disclosure or SSRF respectively.

Because XML parsing is intrinsic to MarkLogic's document-oriented data model, XXE in this product class tends to be high-impact: many ingestion and query paths accept XML natively, and the parser default governs all of them ("multiple server paths"). The CVSS vector reflects this profile: Confidentiality: High (arbitrary local file read / outbound request), Integrity: None (the description does not assert modification), Availability: Low (potential parsing/resource disruption from entity expansion or remote fetch hangs), Scope: Unchanged, Privileges Required: Low.

Note on scope: the description specifically says entity processing is enabled "by default," implying the exposure is a configuration default rather than a code path requiring a non-default flag. That materially broadens the set of affected deployments — any instance on an affected version that has not disabled external entities is potentially in scope.

Exploitation Scenarios

No public PoC exists for this CVE. The following attack chain is inferred strictly from the vulnerability class (XXE / CWE-611) and the facts in the NVD description ("crafted XML to cause server-side requests or disclosure of local files" via "multiple server paths"). Specific endpoint paths, parameter names, and payload field names are intentionally not invented.

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-exposed MarkLogic Server instance and determines its version falls in 12.x < 12.1.0 or 11.x < 11.3.7. Because the flaw is enabled by default, fingerprinting the version is sufficient to assess likely exposure; no non-default configuration discovery is required. Shodan/censys-style product fingerprinting of MarkLogic Server is the primary identification vector.

2. Triggering the flaw. The attacker locates one of the "multiple server paths" that parse supplied XML (per the description, these exist in multiple places and are default-enabled). They submit a crafted XML document that includes a DOCTYPE with an external entity declaration pointing to a local file:// URI or a remote URI. Because the server resolves external entities by default, the parser attempts to dereference the entity.

3. Execution / extraction method (class level). Two distinct outcomes are described: (a) local file disclosure — the resolved file content is surfaced to the attacker, either directly in the response, via differencing the server's behavior, or through an error message containing the file content; and (b) server-side request forgery — the server issues an outbound request to an attacker-influenced destination. No specific payload syntax beyond the standard external-entity/DOCTYPE pattern should be assumed; the description does not provide one.

4. Post-exploitation impact. Local file disclosure can expose configuration, credentials, secrets, or application data readable by the MarkLogic process, enabling lateral movement or privilege escalation against the host or the data platform. SSRF can be used to reach internal-only services, cloud metadata endpoints (in cloud-hosted deployments), or to perform internal port scanning and request smuggling. Depending on what the file disclosure yields, impact can extend well beyond the single server.

Because no exploit code, PoC, or Nuclei template is available, defenders should treat the exploit as theoretical-but-trivial for the class: XXE is a well-understood, low-sophistication technique, and the only gating factor here is (a) version and (b) whether external entity processing has been administratively disabled.

Impact Assessment

• Confidentiality: High — disclosure of local files (arbitrary read within the MarkLogic process's permissions) and/or SSRF to internal resources.
• Integrity: None — the description does not assert write or modification capability.
• Availability: Low — entity resolution and remote fetch can cause delays or resource consumption; no denial-of-service is asserted.
• Privileges Required: Low — an authenticated, low-privileged principal is sufficient; this is not an unauthenticated pre-auth flaw per the vector.
• Attack Vector: Network, Complexity: Low, User Interaction: None — trivially reachable; no victim interaction needed.

Business impact: MarkLogic is a document database widely used in regulated and data-intensive environments (government, financial services, healthcare, media). XXE in such a platform threatens the confidentiality of the data corpus and the host's local filesystem. Because the flaw is default-on, the affected population is broad across both the 11.x and 12.x branches, and because it spans "multiple server paths," remediation via a single input filter is unlikely to be complete.

Blast radius: Any MarkLogic 12.x instance below 12.1.0 and any 11.x instance below 11.3.7 that has not explicitly disabled external entity processing. Multi-tenant or internet-exposed instances carry the highest risk. No affected version list is provided by tracked sources beyond the branch ranges in the description.

Detection Guidance

Sigma Rule

title: Potential XXE Exploitation Against Progress MarkLogic Server (CVE-2026-85970)
id: 8f1c2c3a-7a4e-4b1e-9d2a-0c9b7e5f1a01
status: experimental
description: Detects XML payloads containing external entity declarations submitted to MarkLogic Server paths, consistent with CVE-2026-85970 XXE attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85970
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
  selection_body:
    - 'DOCTYPE'
    - 'SYSTEM'
    - 'ENTITY'
  selection_xxe:
    - 'file://'
    - 'http://'
    - 'https://'
    - 'expect://'
    - 'php://'
    - 'gopher://'
  condition: selection_method and all of selection_body and 1 of selection_xxe
falsepositives:
  - Legitimate XML documents that include DOCTYPE declarations with external entities
  - Application integrations that intentionally fetch external DTDs
level: high
tags:
  - attack.t1190
  - cwe.611

YARA Rule

rule CVE_2026_85970_MarkLogic_XXE_Request
{
    meta:
        description = "Detects XML external entity (XXE) payloads targeting Progress MarkLogic Server (CVE-2026-85970)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85970"
        date = "2026-01-01"
        severity = "high"
    strings:
        $doctype = "DOCTYPE" ascii nocase
        $entity  = "ENTITY" ascii nocase
        $system  = "SYSTEM" ascii nocase
        $file    = "file://" ascii nocase
        $http    = "http://" ascii nocase
        $https   = "https://" ascii nocase
        $meta    = "169.254.169.254" ascii
    condition:
        $doctype and $entity and ($system) and (any of ($file, $http, $https, $meta))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85970 Progress MarkLogic Server XXE Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"DOCTYPE"; nocase; content:"ENTITY"; nocase; pcre:"/(SYSTEM|PUBLIC)/i"; pcre:"/(file|http|https|gopher|expect|php):\/\//i"; reference:cve,2026-85970; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85970; classtype:web-application-attack; sid:2026859701; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method in ("POST","PUT") and
   wildcard(http.request.body.text, "*DOCTYPE*") and
   wildcard(http.request.body.text, "*ENTITY*")]
  [http where wildcard(http.request.body.text, "*SYSTEM*") and
   (wildcard(http.request.body.text, "*file://*") or
    wildcard(http.request.body.text, "*http://*") or
    wildcard(http.request.body.text, "*https://*"))]

Splunk SPL Query

index=web OR index=proxy
| eval body = lower(coalesce(request_body, http_request_body, message, ""))
| where like(body, "%doctype%") AND like(body, "%entity%")
   AND (like(body, "%system%") OR like(body, "%public%"))
   AND (like(body, "%file://%") OR like(body, "%http://%")
        OR like(body, "%https://%") OR like(body, "%169.254.169.254%"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as src_ips values(uri) as uris by dest_host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,marklogic,xxe,">
  <rule id="20268597" level="12">
    <if_sid>31100,31101,31103,31104</if_sid>
    <match>DOCTYPE</match>
    <match>ENTITY</match>
    <match>SYSTEM|PUBLIC</match>
    <regex>file://|http://|https://|gopher://|expect://|php://|169\.254\.169\.254</regex>
    <description>CVE-2026-85970: Potential XXE attack against Progress MarkLogic Server (external entity resolution attempt)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85970,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor workaround is published and no affected-version list beyond the branch ranges in the CVE description is available. The primary remediation is version upgrade.

1) Immediate mitigations

• Upgrade to MarkLogic Server 12.1.0 (for the 12.x branch) or 11.3.7 (for the 11.x branch), which per the CVE description are the versions in which the default-enabled external entity behavior is no longer present in "before" scope.
• Until upgraded, restrict network access to MarkLogic Server administrative and XML-ingesting paths to trusted networks only (do not expose directly to the internet).
• Where the platform permits, disable external entity / DTD processing at the parser or application configuration level; because the description says the behavior is enabled "by default in multiple server paths," this must be applied comprehensively rather than to a single path.
• Apply least-privilege to the OS account running MarkLogic so that any successful file disclosure is limited to files that account can read.

2) Patch / upgrade steps

• Identify all instances in the 12.x and 11.x branches and record exact versions.
• Stage upgrade to 12.1.0 or 11.3.7 in a non-production environment; validate XML ingestion workflows.
• Because no official patch metadata is tracked (Vendor Fix: N/A), confirm the fixed version and any additional parser configuration requirements directly with Progress support before production rollout.
• After upgrade, re-test XML ingestion paths for external entity handling.

3) Long-term hardening

• Adopt an XML parser policy that disables external entity and external DTD resolution by default across all services, and enforce it via configuration baseline.
• Deploy the detection rules above (Suricata/Wazuh at the perimeter, Sigma/Elastic/Splunk at the application-log layer) to catch XXE attempts regardless of patch state.
• Enforce egress filtering to prevent SSRF to internal services and cloud metadata endpoints (block 169.254.169.254 where not required).
• Add XML security testing (XXE, SSRF, entity expansion) to CI/CD for any service that parses XML before exposing it to untrusted input.

References

• NVD — CVE-2026-85970: https://nvd.nist.gov/vuln/detail/CVE-2026-85970
• CWE-611: Improper Restriction of XML External Entity Reference: https://cwe.mitre.org/data/definitions/611.html
• OWASP — XML External Entity (XXE) Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
• Progress MarkLogic Server product documentation and security advisories (verify fixed versions 12.1.0 / 11.3.7 directly with vendor): https://www.progress.com/marklogic
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85970 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No exploit-in-the-wild evidence, threat actor attribution, or public PoC is currently associated with CVE-2026-85970. The CVE is not in CISA KEV, no Nuclei template or exploit code is publicly tracked, and no EPSS score has been assigned by FIRST.org.