External risk intelligence

MarkLogic Server XQuery Injection in Deprecated Management API

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-85948

The vulnerability resides in a Management API, which is a common administrative interface for database and server products. These management services are frequently exposed to network or internet access for remote administration, and the requirement for manage-level privileges indicates an interface typically accessible to authorized users via web or API channels.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in Progress MarkLogic Server that could allow an attacker with administrative privileges to gain persistent control of the system. This issue is present in certain versions of the server's Management API.

Unauthorized administrative control is possible.
This affects administrative interfaces accessed remotely.
Confirm if your MarkLogic Server is impacted.

Attack Path

How an attacker could exploit the issue

An attacker with manage-user privileges could exploit this flaw by sending specially crafted requests to a deprecated Management API. This could allow them to gain persistent administrative control over the server.

Requires manage-user privileges and network access.
Triggered via a deprecated Management API.
Results in persistent administrative control.

Live Threat

Current exploitation, exposure, and threat context

A deprecated Management API package path in Progress MarkLogic Server could allow a remote attacker with specific privileges to gain persistent administrative control. This could affect system data and service behavior when accessed through the affected API.

System data and service behavior.
Exploitation via a deprecated Management API.
Persistent unauthorized administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this vulnerability in Progress MarkLogic Server. The first practical move is to identify all instances of the affected MarkLogic versions, confirm their network reachability and business criticality, and then determine the accountable owner for remediation planning.

Application owners should own the issue.
Verify network exposure and business criticality.
Plan vendor coordination and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress MarkLogic Server?

MarkLogic Server is an enterprise-grade multi-model database platform. It is designed to integrate, store, and search complex data sets, often serving as the backend for large-scale applications, data hubs, and content management systems that require high availability and robust administrative controls.

What does XQuery injection mean in CVE-2026-85948?

This vulnerability involves Improper Privilege Management, classified as CWE-269. In the context of this CVE, it means the software fails to properly restrict the execution of XQuery commands within a specific Management API path. This allows an attacker to manipulate server-side queries to escalate their authority, effectively gaining unauthorized control over administrative functions.

How is this vulnerability triggered?

An attacker must send a specially crafted request to a specific deprecated Management API package path. Importantly, the vulnerability does not trigger through standard data queries or public-facing application endpoints; it requires the attacker to interact specifically with the legacy administrative interface.

Is my instance of MarkLogic Server at risk?

According to Halo Surface Signal, this vulnerability resides in a Management API, which is often configured for remote administration. If your management interfaces are reachable over the network or the internet, the risk increases, as these paths are typically designed for authorized users to perform sensitive system operations.

What should I do first to address CVE-2026-85948?

Begin by auditing your environment to identify all servers running the affected versions of MarkLogic. Once you have a list, evaluate the network accessibility of your management interfaces and coordinate with your application owners to plan for the necessary version updates provided by the vendor.

References

community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.