MarkLogic Server EUVD-2026-97517

Exploitation requires an existing authenticated account with query-execution access to MarkLogic Server (per CVSS PR:L and the description); it is not reachable by a fully anonymous attacker. The specific trigger is invoking an XQuery evaluation function (e.g., dynamic eval functionality) that fails to enforce the additional required evaluation privilege, allowing a user lacking that privilege to have the query evaluated with elevated permissions. Affected deployments are MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7; versions 12.1.0 and 11.3.7 and later are not affected. Limiting factors: the attacker must be able to submit queries to the server, so instances that restrict query access to trusted operators or isolate MarkLogic from untrusted networks substantially reduce exposure; no user interaction is required and attack complexity is low once query access is held.

This is a genuine high-priority issue rather than a CVSS-inflated one, though some caveats apply. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with a scope change and High confidentiality/integrity/availability impact - consistent with the description of an authenticated query-executor escalating to server-side code execution with elevated permissions. The 9.9 score is credible because the scope change plus full CIA impact reflects a privilege-boundary break (CWE-269). However, several key risk signals are MISSING from the input: there is no EPSS score, no CISA KEV listing, no SSVC decision data, and no public exploit (POC) reference, so exploitation likelihood cannot be quantified. Exploitation status is therefore 'no public exploit identified at time of analysis.' The flaw is NOT fully unauthenticated - PR:L means an attacker must already hold query-execution access, which meaningfully limits the attacker population to users or compromised accounts that can submit queries. Reported by the vendor (security@progress.com) and classed as Privilege Escalation/RCE, this warrants prompt patching for any internet- or multi-tenant-exposed MarkLogic instance, but absent EPSS/KEV evidence it should be treated as high-severity-but-not-yet-known-exploited.

An attacker who already holds a low-privilege MarkLogic account with query-execution access (for example, a limited application or analyst account, or a compromised credential) submits a crafted request invoking an XQuery evaluation function without holding the additional evaluation privilege that should gate it. Because the privilege check is bypassed, the query is evaluated server-side with elevated permissions, yielding arbitrary code execution. No public exploit code was identified in the provided data, and no user interaction is required.