MarkLogic Server CVE-2026-7329

Exploitation requires an authenticated account that holds a low-privileged MarkLogic REST role (PR:L) with network reach to a MarkLogic App Server exposing the SQL, SPARQL, or Optic REST query interfaces; the attack is performed by issuing queries through one of those three specific interfaces. No user interaction and no pre-existing administrative privilege are needed. Limiting factors: default anonymous/unauthenticated access is not sufficient - the attacker must already possess valid low-tier REST credentials, and the target must be running an unpatched version below 11.3.6 or 12.0.3 with those REST query endpoints enabled and reachable.

This is a genuine high-priority issue rather than an inflated CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H) describes network-reachable, low-complexity exploitation requiring only a low-privileged authenticated account, no user interaction, and a scope change reflecting the escalation from user to administrator - all consistent with the description. The main mitigating factor is PR:L: an attacker needs a valid low-privileged REST credential, so this is a post-authentication flaw, most dangerous as an insider-privilege-escalation or credential-theft-followup vector rather than a purely anonymous internet attack. No EPSS score, SSVC decision, or POC was provided in the input, and it is not in CISA KEV, so real-world exploitation is currently unproven - the severity rests on the authorization-bypass impact, not on evidence of active abuse. Note the potential nuance: 'authenticated user' with PR:L means default anonymous access is not sufficient; verify that low-privileged REST roles are only issued to trusted principals in your environment.

An insider or an attacker who has phished or otherwise obtained a low-privileged MarkLogic REST account sends crafted SQL, SPARQL, or Optic queries to the server's REST query interface. By abusing the improper privilege handling in those interfaces, the queries execute with administrator authority, letting the attacker read restricted collections and perform privileged administrative operations. No public exploit is identified at time of analysis, and low attack complexity (AC:L) means a working technique would be straightforward to reuse once discovered.