Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-85955: MarkLogic Server lets attacker run code with higher rights

CVE-2026-85955 · published 6 days ago

Summary

Versions of MarkLogic Server 12 before 12.1.0 and 11 before 11.3.7 let anyone who can send queries run certain commands without the extra permission normally required. This could let a remote attacker execute code on the server with more privileges than intended. Update to the latest version of MarkLogic Server or apply the vendor's patch to restore proper permission checks.

What to do

Update progress software corporation marklogic server to version 11.3.7 or later.

Affected software

Vendor	Product	Affected versions
progress software corporation	marklogic server	< 11.3.7

Original advisory text

Improper privilege management in Progress MarkLogic Server xdmp:eval-in

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.

References

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulle... vendor-advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-269Improper Privilege Management

Timeline

Published12 Oct 2026

Updated15 Oct 2026

First seen12 Oct 2026

Sources

CVE-2026-85955 · NVD

CVE-2026-85955 · MITRE

Track software like this

Free during beta