MarkLogic Server EUVD-2026-53425

Exploitation requires an authenticated account holding at least a low-privileged REST role (CVSS PR:L) with network access to the MarkLogic REST API, and the attack is directed specifically at the REST API document patch operation targeting the Security database. What limits it: the attacker must already possess valid REST API credentials - it is not exploitable by fully unauthenticated actors - and the target must be running a vulnerable version (MarkLogic before 11.3.6 or before 12.0.3) with the REST API reachable by the attacker. No special non-default configuration, user interaction, or elevated starting privilege is required beyond that baseline REST role, which makes the condition easy to meet in typical application deployments.

The signals align toward genuinely high risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) indicates a network-reachable, low-complexity attack requiring only low privileges, no user interaction, and yielding full confidentiality, integrity, and availability impact across a scope boundary. Any account with a basic REST role - the kind commonly issued to application service accounts - meets the PR:L bar, so the practical attacker population is broad in real deployments. Tempering this: no EPSS score was provided, the CVE is not in CISA KEV, and no public POC is referenced, so there is no evidence of active or automated exploitation yet. The realistic assessment is a pre-exploitation, high-value target - the barrier (a valid low-privileged credential) is modest and the payoff (Security database takeover) is severe, so it should be prioritized despite the absence of in-the-wild signals. No conflicting signals were identified in the provided data; the chief gap is the missing EPSS and POC status.

An attacker who has obtained or been issued a low-privileged REST role (for example, a compromised application service account) sends a crafted document patch request through the MarkLogic REST API targeting the Security database, altering role or permission documents to grant themselves administrative authority. Because attack complexity is low and no user interaction is needed, a single valid low-privileged credential is enough to pivot to full control of the server's authorization model. No public exploit code is currently identified, so this would require the attacker to develop the technique.