MarkLogic Server CVE-2026-7327

Exploitation requires the attacker to possess a valid MarkLogic Server account with the administrative REST role assigned - this is a high-privilege role, not a standard user account, making opportunistic exploitation difficult. A second, non-negotiable condition is that a higher-privileged user (e.g., a super-administrator) must interact with or trigger processing of the attacker-controlled documents; this aligns with the UI:R metric in the CVSS vector. The vulnerability resides in the REST API document processing pipeline specifically, so access to that pipeline endpoint is required. What limits exploitation: the PR:H requirement rules out unauthenticated or low-privilege attackers; the UI:R requirement means the attacker cannot independently trigger full impact and must induce a more privileged user to act; no special network position beyond network reachability to the REST API is required (AV:N, AC:L).

The NVD CVSS base score of 8.1 (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) reflects high potential impact but meaningful exploitation prerequisites. PR:H confirms that the attacker must already hold an administrative REST role - a high-privilege position - which substantially raises the bar compared to unauthenticated or low-privilege flaws. UI:R introduces a second gating condition: a higher-privileged user must interact with the attacker-controlled documents before privilege escalation occurs. No EPSS score was provided in source data, and the vulnerability is not listed in CISA KEV, so there is no confirmed in-the-wild exploitation signal. No public proof-of-concept exploit has been identified. In practice, this vulnerability is most dangerous in multi-tenant or multi-team MarkLogic environments where administrative REST roles are distributed to operational or developer users who are not fully trusted super-administrators. The combination of PR:H and UI:R makes opportunistic, broad exploitation unlikely; targeted insider-threat or compromised-admin scenarios represent the realistic threat model.

An attacker who has obtained or been granted an administrative REST role account submits specially crafted documents into the MarkLogic REST API document processing pipeline. When a higher-privileged user - such as a security administrator or super-admin - accesses or processes these documents, the pipeline triggers the privilege escalation flaw, granting the attacker access to sensitive server-side data that their original role should not permit them to read or modify. No public proof-of-concept has been identified, but the attack is conceptually straightforward once the role-level access is established.