CVE-2026-85948
Improper privilege management in Progress MarkLogic Server Management API
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 11.3.7, 12.1.0
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.
Affected versions
- Progress Software Corporation MarkLogic Server
From 11.0.0 · fixed in 11.3.7; From 12.0.0 · fixed in 12.1.0