DEV Community

StarkMan
StarkMan

Posted on

From Query Access to Root of the Database: Inside the MarkLogic Privilege Escalation Chain

#security #vulnerability #marklogic #cve202685947

From Query Access to Root of the Database: Inside the MarkLogic Privilege Escalation Chain

Privilege escalation is rarely a single step. In MarkLogic Server before the October 2026 fixes, several vulnerabilities offered starting points that were unusually close to the finish line.

Vulnerability overview

The bulletin fixed 31 vulnerabilities across MarkLogic Server. Three carry CVSS v3.1 scores of 9.9: CVE-2026-85947, CVE-2026-85948 and CVE-2026-85955. Two carry 9.6: CVE-2026-85956 and CVE-2026-9191. Affected releases are 12.0 through 12.0.3 and 11.0 through 11.3.6.

Mechanism and exploitation conditions

Consider what each starting point really requires.
A query-execution account is the lowest bar in the set. Such an account can already ask the database questions. CVE-2026-85955 means it could also invoke an XQuery evaluation function without the required evaluation privilege, which turns a read-oriented identity into a code-execution channel.
A forest-management role is a modest elevation above that, and CVE-2026-85947 means the holder could create a persistent unauthorised administrator account. An account that persists past the initial intrusion is worth more than any single action, because it survives credential rotation on the original identity.
Reaching a deprecated management API gives an attacker the third path. CVE-2026-85948 turns an injection flaw there into administrative capability.
Each of these flaws changes the assumed starting point. None requires administrator rights.

Impact

The destination is the same in every case: administrative control of a database platform holding enterprise content. Progress warns that exploitation could produce unauthorised administrative actions, unauthorised access to or modification of data, credential exposure, code execution, service disruption and reduced auditability. The vendor adds that affected instances show no advance warning and continue to operate normally.
No exploitation in the wild and no public proof-of-concept had been confirmed.

Affected products and scope

The affected versions are MarkLogic Server 12.0 through 12.0.3 and 11.0 through 11.3.6. The fixed releases are 12.1.0 and 11.3.7. Retired releases including 10.x are not patched. Progress reports that Data Cloud customers were patched.

Exposure context

ZoomEye returned 4,545 assets matching app="MarkLogic" in a successful stored query. The figure counts internet-visible deployments, not confirmed vulnerable hosts.

Remediation and mitigations

Move to 12.1.0 or 11.3.7, then map the chain inside your own estate. For each role that can query, evaluate, manage or administer forests, record who holds it and why. Remove the rights that no longer have a purpose. Because the persisted-account technique outlasts the original intrusion, audit accounts for unexpected additions and rotate credentials for identities that carried elevated rights before patching.

References

Top comments (0)