CVE-2026-85954: CWE-269: Improper Privilege Management in Progress Software Corporation MarkLogic Server

Progress MarkLogic Server versions 11.x prior to 11.3.7 and 12.x prior to 12.1.0 contain an improper privilege management vulnerability (CWE-269). The server evaluates user-controlled inputs supplied to specific higher-order XQuery functions with elevated privileges, enabling an attacker to escalate privileges beyond their authorized level. The vulnerability has a CVSS 3.1 base score of 8.6, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact is high on integrity but no confidentiality or availability impact is noted. No known exploits are reported in the wild, and no vendor patch links were provided in the input data.

An attacker can escalate privileges beyond their granted permissions by exploiting the improper evaluation of user-controlled values in higher-order XQuery functions. This could allow unauthorized modification or manipulation of data or system state within MarkLogic Server. The vulnerability does not affect confidentiality or availability but poses a significant integrity risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory was provided in the input data, users should monitor Progress Software Corporation's advisories for updates and apply any official fixes once available. Until then, restrict access to vulnerable versions and limit exposure to untrusted inputs where possible.