Progress MarkLogic CVE-2026-85962

Exploitation requires that the MarkLogic Server instance is explicitly configured to use SAML authentication - the vulnerability lives in SAML assertion processing, so deployments using only internal, Kerberos, or certificate-based authentication are not affected by this specific flaw. The affected server's SAML endpoint must also be network-reachable by the attacker. Beyond those two conditions there are no limiting factors: per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special timing or elevated privileges are needed, making SAML-configured instances exploitable by remote unauthenticated attackers. The primary limiter on real-world blast radius is therefore the non-default SAML configuration requirement, not attacker-side difficulty.

This is a credible, moderately high-priority issue for the specific population of affected deployments, but not a broad emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5 High) is internally consistent with the description: a network-reachable, unauthenticated attacker (PR:N) exploiting a SAML assertion-validation flaw, with the impact scored as integrity-only (I:H) reflecting unauthorized access/identity spoofing rather than data destruction. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation-probability and automatability signals are entirely absent - there is no evidence of active exploitation and no public exploit identified at time of analysis. The vendor describes the advisory as a 'Critical Security Alert Bulletin,' which is in mild tension with the 7.5 (High, not Critical) base score; this likely reflects the authentication-bypass nature being treated as business-critical by Progress rather than a scoring discrepancy. One caveat to flag: the impact is scored C:N/I:H, yet an authentication bypass yielding 'unauthorized access' to a database server would typically also expose confidentiality - defenders should not assume data reads are out of scope. Net: a real priority for any MarkLogic deployment using SAML, deprioritizable where SAML is not configured.

An organization runs MarkLogic Server 11.x or 12.x configured to authenticate users via SAML single sign-on. A remote, unauthenticated attacker crafts or replays a SAML assertion that should fail validation (e.g., a forged, altered, or improperly-signed assertion), and the flawed SAML processing accepts it, logging the attacker in as a legitimate or privileged user without valid credentials. No public exploit code was identified at time of analysis, and the network/low-complexity vector means exploitation would be straightforward once the validation weakness is understood.