External risk intelligence

Progress MarkLogic Server Privilege Escalation and Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-85955

Progress MarkLogic Server is a database platform. While it may be exposed to the internet in some specific configurations or as part of public-facing web architectures, it is primarily a backend data storage and processing component. Its role is typically behind application layers rather than being a public-facing edge service by design, making internet-facing exposure possible but not the default or standard deployment.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Progress MarkLogic Server, a database platform, and could allow an authenticated attacker to execute code on the server with elevated permissions. The primary concern is to confirm if this technology is in use and assess potential exposure.

Database flaw lets attackers run unauthorized code.
Understand if MarkLogic is part of your systems.
Confirm relevance and assess exposure carefully.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to execute queries on a MarkLogic Server could potentially trigger this vulnerability. By exploiting a weakness in how the server handles XQuery evaluation, the attacker could execute arbitrary code on the server with higher privileges than intended. This could lead to a significant compromise of the server and the data it manages.

Requires query-execution access.
Invokes XQuery evaluation function improperly.
Server-side code execution with elevated permissions.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker with query-execution access could exploit this vulnerability to execute arbitrary code on the server with elevated permissions. This could affect the integrity and availability of the MarkLogic Server, potentially leading to unauthorized access to or modification of stored data.

Server-side code execution.
Unauthenticated code execution over network.
Compromise of server and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Progress MarkLogic Server vulnerability requires action from teams managing application data and the underlying infrastructure. The first practical step is to identify all MarkLogic instances, determine their reachability and business criticality, and then assign ownership for remediation.

Application owners and infrastructure teams.
Confirm instance reachability and business criticality.
Plan and execute remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress MarkLogic Server?

Progress MarkLogic Server is a specialized multi-model database platform designed to store, manage, and search complex data structures. Organizations use it as a robust backend component to power data-intensive applications, handling everything from document storage to sophisticated analytical queries.

What does CVE-2026-85955 mean?

This vulnerability involves Improper Privilege Management (CWE-269). It means the software fails to properly check if a user has the necessary rights before letting them run certain powerful XQuery evaluation functions, allowing an attacker to bypass security restrictions and execute unauthorized code.

How is this vulnerability triggered?

An attacker must already have query-execution access to the server to trigger this flaw. Simply accessing the network or the server login page is not enough to exploit it; the attacker must be able to submit and run XQuery commands against the database engine.

Is my instance at risk according to Halo Surface Signal?

While Halo Surface Signal notes that MarkLogic is typically a backend component, internet-facing exposure is possible depending on your specific architecture. You should verify if your instance is reachable from the public internet or if it remains strictly within internal networks.

What should I do first to address this?

Your first step is to locate all deployments of MarkLogic Server within your environment. Once identified, evaluate whether these instances are accessible to unauthorized parties, determine the business importance of the data they hold, and prepare to implement the vendor's updates.

References

community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.