Progress MarkLogic Server prior to 12.1.0 and 11.3.7 allows an attacker who has query‑execution privileges to call the xdmp:eval‑in function without the required additional privilege. The function can then execute arbitrary server‑side code under elevated permissions. The vulnerability is a direct privilege escalation that enables remote code execution on the server, compromising confidentiality, integrity, and availability of the entire database system.

Vendors affected include Progress Software Corporation’s MarkLogic Server. All releases in the 12.x branch earlier than version 12.1.0 and in the 11.x branch earlier than version 11.3.7 are vulnerable. Specific affected versions are not enumerated beyond these major releases.

The CVSS score of 9.9 indicates critical severity, and the vulnerability is exploitable by a remote attacker who can gain query‑execution access. While no EPSS score is reported, the lack of a KEV listing suggests no known widespread exploitation yet. The attack vector is remote, requiring an attacker to have authenticated query‑execution privileges, which may be obtained through other authentication weaknesses or compromised accounts. Once achieved, the attacker can execute code with elevated rights, leading to full compromise of the server.