External risk intelligence

Progress MarkLogic Privilege Escalation via REST Query Interfaces.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-7329

The vulnerability affects REST query interfaces (SQL, SPARQL, and Optic) in MarkLogic Server. As these are commonly deployed as internet-facing API endpoints or integration gateways to allow external applications or services to query database content, the surface is frequently exposed to the network in typical enterprise deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Progress MarkLogic Server's REST query interfaces could allow an authenticated user to gain administrator privileges, potentially leading to unauthorized data access and privileged operations. The primary concern is confirming if your environment uses the affected versions of MarkLogic Server and is exposed.

Low-privilege user gains admin rights.
Enables unauthorized access and operations.
Confirm MarkLogic Server relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker who has already gained low-level access to Progress MarkLogic Server can exploit this vulnerability. By sending specially crafted requests to the SQL, SPARQL, or Optic REST query interfaces, they can elevate their privileges to that of an administrator. This allows them to perform sensitive operations and access data they shouldn't be able to.

Authenticated access required.
Triggered via REST query interfaces.
Allows privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

An improper privilege management vulnerability in Progress MarkLogic Server's REST query interfaces could allow an authenticated user with limited privileges to gain administrator access. This could then enable unauthorized data access and the execution of privileged operations.

Administrator privileges and sensitive data.
Low-privileged user escalates access.
Unauthorized data access and operations.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for Progress MarkLogic Server, such as infrastructure or platform owners, should prioritize addressing this privilege escalation vulnerability. The initial practical step involves identifying all instances of the affected MarkLogic Server, confirming their network exposure and business criticality, and then locating the accountable owner to plan remediation efforts based on the assessed risk.

Identify MarkLogic Server instances.
Verify network exposure and criticality.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress MarkLogic Server?

Progress MarkLogic Server is a multi-model database engine designed to store, manage, and query complex data, including JSON, XML, and RDF triples. It is widely used in enterprises to integrate data from diverse silos into a unified platform. Users interact with this data through various specialized interfaces, such as those supporting SQL or SPARQL queries, which allow applications to retrieve or analyze information stored within the system.

How does CVE-2026-7329 allow privilege escalation?

This vulnerability is classified as improper privilege management, or CWE-269. It occurs when the software fails to correctly restrict the actions a user can perform based on their assigned role. In this case, the flaw exists within the database's REST query interfaces. An attacker who has legitimate, low-level access can manipulate these interfaces to bypass security checks, effectively granting themselves administrative rights.

Do I need administrator access to trigger this bug?

Yes. This vulnerability is not accessible to unauthenticated users or anonymous guests. An attacker must already possess a valid, low-privileged account on the system to initiate the exploit. Simply sending requests without prior authentication or valid credentials will not trigger the privilege escalation.

How do I know if my systems are at risk?

According to Halo Surface Signal, this issue is particularly relevant if your MarkLogic REST query interfaces are configured as internet-facing API endpoints or integration gateways. If these interfaces are exposed to the network to allow external services to query your database, they represent a larger attack surface compared to instances restricted to internal, private networks.

What should I do first to manage this threat?

Your first step is to inventory your environment to locate all running instances of MarkLogic Server and determine which versions are in use. Once identified, evaluate whether those instances are exposed to the network. Prioritize your response by verifying if your current version is older than 11.3.6 or 12.0.3, as these versions contain the necessary security updates to address the privilege management flaw.

References

community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.