Two Critical MarkLogic Flaws Let Delegated Managers Seize Admin Control

Progress Software has disclosed 31 vulnerabilities in its MarkLogic Server database. All were published on October 12, and five are rated critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0.

The 11.3 line is the long-term support (LTS) release, while the 12 line, which Progress calls an innovation release, got no patched 12.0 build: the fix shipped straight in 12.1.0, which also adds new features. Installing the August patches (11.3.6 and 12.0.3) is not enough — both of those releases are affected by the new flaws.

What the critical flaws allow

Three of the five critical flaws are scored 9.9 out of 10 on the CVSS scale, the other two 9.6. In every case the attacker must already hold some privilege or a way to run code on the server.

Two involve "forests" — collections of documents attached to a database. CVE-2026-85947 (9.9) lets an account with forest-management rights create a persistent administrator account and thereby take complete control of the server. CVE-2026-85948 (9.9), an XQuery injection in a deprecated Management API path, grants persistent admin control. CVE-2026-85955 (9.9) allows server-side code to run with elevated permissions, CVE-2026-85956 (9.6) reaches what Progress calls "security-critical data" outside the account's own database, and CVE-2026-9191 (9.6) can compromise an authenticated session.

According to Progress, none of the 31 flaws is known to have been exploited; none was in CISA's Known Exploited Vulnerabilities catalog as of October 13. The company lists no workaround for those who cannot upgrade yet.

The rest, and upgrade pitfalls

Of the remaining flaws, 24 are rated high and two medium. Many surface only when a particular feature is in use: SAML, OAuth, or password-based Kerberos authentication, cloud hosting on Azure and Linux, the Query Console, and the deprecated OpsDirector and InfoStudio components. Separately, CVE-2026-85959 meant successful logins were not always recorded in the audit log.

The upgrade brings behavior changes that can break existing code and automation: deprecated APIs and components are removed, XML external entity processing is off by default, S3 connections default to HTTPS, and privilege checks are tightened. Progress strongly urges customers to read the upgrade notes and the list of incompatibilities first. Notably, the documentation does not say whether upgrading removes an administrator account created via CVE-2026-85947 before the upgrade.

This is the second batch in 68 days: on August 5, Progress disclosed 10 flaws, seven of them critical. Both times the fixes shipped before the CVE records appeared.

Source: The Hacker News