MarkLogic Server EUVD-2026-53424

Exploitation requires the target MarkLogic Server deployment to have SAML single sign-on explicitly enabled and its SAML SSO endpoint reachable by the attacker - this configuration is the exact prerequisite named in the vendor description ('affects deployments with SAML single sign-on enabled'). Where SAML SSO is enabled, no authentication, credentials, or user interaction are needed (PR:N/UI:N), and the attacker forges an assertion to impersonate any user including administrators. The primary limiting factor is that deployments using non-SAML authentication (internal, LDAP, Kerberos, or SSO disabled) are not exploitable, and network-level restrictions on the SSO endpoint further reduce reachable exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a network-reachable, low-complexity, pre-authentication attack with high confidentiality and integrity impact and no availability impact - consistent with an authentication bypass rather than a crash. This is a genuine priority for any exposed SAML-enabled deployment, not merely a high-CVSS-but-low-real-risk finding, because it grants administrator impersonation without credentials. That said, real-world exposure is gated by a specific precondition: SAML SSO must be enabled, so environments using MarkLogic's other authentication methods are not affected. No EPSS score was provided in the input, and there is no KEV listing or POC evidence, so exploitation appears theoretical rather than observed today - treat the absence of an EPSS/POC signal as missing data, not as proof of low risk. The A:N availability rating is appropriate for an auth bypass; the C:H/I:H ratings are well justified by full user/admin impersonation.

An attacker who can reach a SAML-enabled MarkLogic App Server crafts a SAML response/assertion naming a privileged account (e.g., an admin) and, because the signature is not properly verified, submits it to the SSO endpoint. MarkLogic accepts the forged assertion and grants an authenticated session as that user, giving the attacker administrative control over the database. No credentials, no user interaction, and low attack complexity are required; no public POC has been identified at time of analysis.