CVE-2026-85948: Improper privilege management in Progress MarkLogic Server Management API
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments are affected?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. The flaw is in a deprecated Management API package path.
What access does an attacker need to exploit this issue?
An attacker must be able to reach the Management API remotely and already have manage-user-level privileges. No user interaction is required.
What could successful exploitation allow?
Successful exploitation can give the attacker persistent unauthorized administrative control of the MarkLogic Server.
What versions address the issue?
Upgrade 12.x deployments to 12.1.0 or later, and 11.x deployments to 11.3.7 or later.