CVE-2026-85955: Improper privilege management in Progress MarkLogic Server xdmp:eval-in
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments are affected?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected.
What access does an attacker need to exploit this issue?
An attacker needs remote query-execution access. No user interaction is required.
What is the potential impact of successful exploitation?
An attacker may invoke an XQuery evaluation function without the additional required evaluation privilege, potentially achieving server-side code execution with elevated permissions. The reported impact includes high confidentiality, integrity, and availability impact.
Which versions address the issue?
Upgrade 12.x deployments to 12.1.0 or later, or 11.x deployments to 11.3.7 or later.