CVE-2026-85948

Name of the Vulnerable Software and Affected Versions MarkLogic Server versions 11.0.0 through 11.3.6 MarkLogic Server versions 12.0.0 through 12.0.9

Description An XQuery injection flaw exists in a deprecated Management API package path. A remote attacker with manage-user-level privileges can exploit this issue to obtain persistent unauthorized administrative control. XQuery injection is a technique where an attacker inserts malicious XQuery code into a query, allowing them to manipulate the database or execute unauthorized commands.

Recommendations Upgrade MarkLogic Server versions 11.0.0 through 11.3.6 to 11.3.7 or later. Upgrade MarkLogic Server versions 12.0.0 through 12.0.9 to 12.1.0 or later. Restrict management API exposure. Enforce least privilege and audit all accounts with manage-user permissions.