CVE-2026-85955 Progress Software Corporation CVE debrief

Who should care

Progress MarkLogic Server administrators, security teams, and IT personnel responsible for managing and securing MarkLogic Server instances should assess exposure and apply necessary patches to prevent potential exploitation.

Why it matters

CVE-2026-85955 is a critical vulnerability in Progress MarkLogic Server that allows remote attackers to invoke XQuery evaluation functions without required privileges, potentially leading to server-side code execution with elevated permissions. Immediate attention is required for administrators to assess exposure and apply patches to prevent potential exploitation.

• Potential server-side code execution with elevated privileges.
• Possible unauthorized access and data breaches.
• Required patching to prevent exploitation.
• Need for immediate assessment and mitigation.

Technical summary

The vulnerability, CVE-2026-85955, is an improper privilege management issue in Progress MarkLogic Server's xdmp:eval-in function. This allows remote attackers with query-execution access to invoke XQuery evaluation functions without the required evaluation privilege, potentially leading to server-side code execution with elevated permissions. Affected versions include MarkLogic Server 11.x releases before 11.3.7 and 12.x releases before 12.1.0.

Defensive priority

Immediate attention is required for Progress MarkLogic Server administrators to assess exposure and apply patches to prevent potential code execution with elevated privileges.

Recommended defensive actions

• Assess exposure by reviewing current MarkLogic Server versions and configurations.
• Apply patches or updates to affected versions (11.x before 11.3.7 and 12.x before 12.1.0).
• Review and restrict query-execution access to minimize potential attack vectors.
• Monitor for suspicious XQuery evaluation function invocations.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and a vendor advisory link for further information. The vulnerability is confirmed to exist in MarkLogic Server 11.x releases before 11.3.7 and 12.x releases before 12.1.0. Limited evidence suggests that remote attackers can exploit this vulnerability to execute server-side code with elevated permissions. Further verification is required to determine the full scope of affected systems and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.