Progress MarkLogic CVE-2026-85953

Exploitation requires the privileged legacy InfoStudio modules to be present and reachable on the target MarkLogic Server (affected: 12.x before 12.1.0 and 11.x before 11.3.7); these legacy modules are the specific feature that fails to validate user-controlled file paths and user-context values. Per the vendor CVSS vector (PR:L), a low-privileged authenticated account is required, which limits exploitation to actors who can reach and authenticate to the server - no user interaction is needed. Limiting factors: successful attack depends on the legacy InfoStudio functionality being enabled/deployed and on the attacker holding at least low-level credentials. Caveat: the 'Authentication Bypass' input tag, if accurate, would remove the authentication prerequisite - this should be confirmed with Progress.

This is a genuine priority for MarkLogic operators, though not a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5) describes a network-reachable, low-complexity flaw requiring only low-level authenticated privileges (PR:L), with a changed scope and high confidentiality impact - consistent with the CWE-22 path-traversal classification and the description's 'unauthorized access to server files.' No EPSS score, CISA KEV entry, or public POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the elevated 8.5 is driven by the CVSS math (scope change plus C:H), not by observed real-world attacks. One tension to verify: the vendor supplied a CVSS vector with PR:L (authenticated), yet one of the input Tags is 'Authentication Bypass,' which implies unauthenticated impact - these signals conflict and should be confirmed with Progress, because if the legacy InfoStudio modules are reachable pre-authentication the real risk is materially higher than PR:L suggests. The description's 'execution under an unintended identity' aligns with the scope change (S:C) and the I:L rating. Net: treat as a high-severity, patch-soon issue for exposed MarkLogic instances, but exploitation realistically presupposes at least some account access unless the auth-bypass tag proves accurate.

An attacker with a low-privileged MarkLogic account (or, if the 'Authentication Bypass' tag holds, a remote attacker needing little or no auth) sends crafted requests to the privileged legacy InfoStudio modules, supplying manipulated file-path and user-context parameters. Because the paths and identity values are not sufficiently validated, the attacker reads server files outside the intended scope and causes operations to run under an unintended identity. No public exploit code was identified at time of analysis, and the network/low-complexity vector means no special tooling or user interaction is required.