XML External Entity injection in MarkLogic - CVE-2026-85957
Published: October 12, 2026
Vulnerability identifier: #VU154130
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85957
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause unintended network access or disclose information.
The vulnerability exists due to improper restriction of XML external entity references in the SAML parser when processing external DTDs or entities. A remote attacker can supply SAML input containing external DTDs or entities to cause unintended network access or disclose information.
Affected software
MarkLogic
How to mitigate CVE-2026-85957
Install security update from vendor's website.
MarkLogic - addressed in versions 11.3.7, 12.1