MarkLogic Server EUVD-2026-97506

Exploitation requires the attacker to already possess a valid MarkLogic account holding 'manage-user'-level privileges (PR:L) - it is NOT a pre-auth flaw. The vulnerable surface is specifically the deprecated Management API package path on MarkLogic Server 12.x before 12.1.0 or 11.x before 11.3.7; deployments on 12.1.0 / 11.3.7 or later are not affected. Key limiting factors: the mandatory pre-existing manage-user credential, and the fact that the affected path is a deprecated API (environments that have already removed or restricted access to the deprecated Management API, or that tightly control manage-user grants, materially reduce exposure). No end-user interaction is required (UI:N), and the attack is remotely reachable wherever the Management API is network-exposed to the authenticated attacker.

This is a genuine high-priority issue, though not an unauthenticated internet-wide emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) is internally consistent with the description: a remote (AV:N), low-complexity (AC:L) attack by an already-authenticated low-privilege principal (PR:L, specifically a 'manage-user'-level account) that crosses a security authority boundary (S:C) to gain full administrative control with total confidentiality, integrity and availability impact. The critical score is driven almost entirely by the scope change and privilege-escalation outcome rather than by ease of initial access - the attacker must FIRST hold a manage-user credential, so PR:L is the key limiting factor and should be weighed heavily. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or weaponization; the status is best characterized as no public exploit identified at time of analysis. The net picture: a legitimately dangerous post-authentication privilege-escalation flaw in a deprecated API path, worth prioritizing for any exposed or multi-tenant MarkLogic deployment, but the mandatory pre-existing manage-user privilege makes mass, opportunistic exploitation far less likely than the raw 9.9 suggests.

An attacker who has obtained or been granted a low-privilege 'manage-user' MarkLogic account (e.g. a limited operations or monitoring user) sends crafted input to the deprecated Management API package path, injecting XQuery that executes with elevated authority. This escalates the limited account into persistent full administrative control of the MarkLogic Server. No public exploit code was identified in the provided data, and exploitation requires the attacker to already hold valid manage-user credentials.