Progress MarkLogic Server CVE-2026-85964

Requires an authenticated MarkLogic Server user with access to the Query Console feature (PR:L per CVSS); the attacker uses Query Console to pass unsafe/traversal path values to a privileged filesystem helper. Exploitation is limited to deployments running the affected versions (12.x before 12.1.0 or 11.x before 11.3.7) and to actors who already hold valid Query Console credentials - there is no unauthenticated path and no code-execution or data-modification outcome, only file read. The requirement for valid credentials and Query Console access is the primary factor limiting real-world exploitation.

This is a credible, moderate-to-high priority issue for organizations running MarkLogic Server, but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7 High) indicates a network-reachable, low-complexity attack that requires only low-privilege authentication (PR:L) and no user interaction, with a scope change (S:C) reflecting that a privileged filesystem helper reads files outside the application's normal authorization boundary. Impact is confidentiality-only (C:H, I:N, A:N) - arbitrary server file disclosure, with no integrity or availability effect. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only source is the vendor's own advisory. The key limiting factor is authentication: an attacker needs valid Query Console credentials, which meaningfully narrows the realistic attacker set to insiders or anyone who has already obtained/compromised a low-privilege account. Conflicting-signal note: none of the exploitation-probability signals (EPSS/KEV/POC) are present, so risk prioritization rests almost entirely on the CVSS vector and vendor description - treat the absence of EPSS/KEV as 'unknown,' not as 'low risk.'

An attacker with valid but low-privilege MarkLogic Query Console credentials submits a query that passes a crafted, traversal-style path (e.g., ../../ sequences) to the privileged filesystem helper, causing the server to read and return files outside the intended directory - such as OS configuration files, credential stores, or other application data. No public exploit code was identified at time of analysis, so exploitation would currently require an attacker to independently develop the technique from the path-traversal (CWE-22) description.