CVE-2026-85955

Summary

A remote attacker with query-execution access can bypass XQuery evaluation privileges to execute server-side code with elevated permissions in Progress MarkLogic Server versions before 12.1.0 and 11.3.7.

Exploitability

Exploitation requires a remote attacker with existing query-execution access, making it moderately difficult but possible to achieve full server compromise through privilege escalation.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the MarkLogic server with elevated privileges, potentially leading to complete system compromise and data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to MarkLogic Server 12.1.0 or 11.3.7 to remediate this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.