CVE-2026-85954: Improper privilege management in Progress MarkLogic Server higher-order XQuery functions
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Server 12.xto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Server 11.xto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which releases need to be remediated?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. Upgrade to 12.1.0 or later in the 12.x line, or 11.3.7 or later in the 11.x line.
What access does an attacker need to exploit this issue?
The attack vector is network-based and requires no prior privileges or user interaction. Exploitation involves supplying user-controlled values to certain higher-order XQuery functions.
What is the potential impact?
An attacker could have user-controlled values evaluated in an elevated security context, potentially gaining permissions beyond those granted to their account. The stated impact is integrity compromise; confidentiality and availability impacts are not indicated.