CVE-2026-85948: CWE-269: Improper Privilege Management in Progress Software Corporation MarkLogic Server
Description
Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, contain an XQuery injection vulnerability in a deprecated Management API package path. This flaw allows a remote attacker with manage-user-level privileges to gain persistent unauthorized administrative control. The vulnerability is classified as improper privilege management (CWE-269) and has a critical severity with a CVSS score of 9.9.
CVSS v3.1
Score 9.9critical
Affected software
Progress Software Corporation
MarkLogic Server
pkg:maven/com.marklogic/marklogic-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85948 is an improper privilege management vulnerability in Progress Software Corporation's MarkLogic Server affecting versions >=11.0.0 <11.3.7 and >=12.0.0 <12.1.0. The flaw exists in a deprecated Management API package path where an XQuery injection can be exploited by a remote attacker possessing manage-user-level privileges. Successful exploitation results in persistent unauthorized administrative control over the server. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical impact on confidentiality, integrity, and availability.
Potential Impact
An attacker with manage-user-level privileges can exploit this XQuery injection vulnerability to escalate privileges and obtain persistent administrative control of the MarkLogic Server. This compromises the confidentiality, integrity, and availability of the affected system, potentially allowing full control over the server environment.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official remediation details are provided, users should monitor Progress Software's advisories for updates. Until a patch is available, restrict manage-user-level privileges to trusted personnel only and consider disabling or restricting access to the deprecated Management API package path if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ProgressSoftware
- Date Reserved
- 2026-09-04T18:42:47.235Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acd01702cdf04f656aa706c
Added to database: 10/12/2026, 15:49:04 UTC
Last enriched: 10/12/2026, 16:03:27 UTC
Last updated: 10/12/2026, 16:08:25 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.