Progress Software disclosed 31 vulnerabilities in MarkLogic Server on October 12, 2026, including five critical flaws that can enable persistent administrative control, elevated server-side code execution or access beyond a delegated administrator’s assigned scope.
The affected releases are MarkLogic 11.x before 11.3.7 and 12.x before 12.1.0. Customers should upgrade to 11.3.7 or 12.1.0; there is no patched release on the 12.0 branch. According to The Hacker News, Progress made the fixes available on September 10 and assigned five vulnerabilities a critical rating, 24 a high rating and two a medium rating.
The August security releases, 11.3.6 and 12.0.3, remain vulnerable to this newly disclosed group of flaws.
Five critical vulnerabilities cross privilege boundaries
The most severe issues require different levels of existing access, but several turn narrowly delegated permissions into control over the wider MarkLogic environment.
| Vulnerability | CVSS | Required position or access | Potential consequence |
|---|---|---|---|
| CVE-2026-85947 | 9.9 | Forest-management privileges | Creation of a persistent unauthorized administrator account |
| CVE-2026-85948 | 9.9 | Manage-user-level privileges | Persistent administrative control through XQuery injection in a deprecated Management API package path |
| CVE-2026-85955 | 9.9 | Query-execution access and the relevant evaluation capability | Server-side code execution with elevated permissions |
| CVE-2026-85956 | 9.6 | Delegated database-administrator privileges | Backup or restoration of forests outside the authorized database scope |
| CVE-2026-9191 | 9.6 | Ability to execute code through affected REST or XDBC paths | Unauthorized actions or compromise of an authenticated session |
The CVE Program record for CVE-2026-85947 classifies the issue as improper privilege management under CWE-269. A remote account with forest-management rights can abuse affected forest operations to establish an administrator account that persists, potentially resulting in complete administrative control. Its CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
The record credits rexnets, through Bugcrowd, with reporting CVE-2026-85947. The same researcher is also credited in the reporting with CVE-2026-85948 and CVE-2026-85956, while WaltWhitehat is credited with CVE-2026-9191.
A separate high-severity issue, CVE-2026-85954, has a CVSS score of 8.6. It involves user-controlled values supplied to certain higher-order XQuery functions being evaluated in an elevated security context, allowing privileges to exceed those assigned to the attacker.
Authentication, cloud and logging risks depend on configuration
Several other vulnerabilities become relevant only where particular authentication methods, cloud platforms or legacy components are in use.
In SAML deployments, CVE-2026-85962 could allow an unauthenticated remote attacker to have MarkLogic accept an assertion that should be rejected. MarkLogic 11.x before 11.3.7 is also affected by CVE-2026-85957, in which the SAML parser can process external DTDs or entities, potentially causing unintended network access or information disclosure.
CVE-2026-85958 concerns OAuth tokens that the server should not accept. The correction adds issuer and audience validation for Ping Identity and other OAuth configurations. CVE-2026-85972 affects password-based Kerberos setups and can allow an attacker with a suitable network position to impersonate the Kerberos authentication service.
Cloud-related issues include CVE-2026-85951 on Azure and CVE-2026-85952 on Linux-based cloud deployments, where an authenticated attacker could reach internal cloud services and obtain cloud credentials. Under affected logging configurations, CVE-2026-85949 and the Azure-specific CVE-2026-85961 could expose security-sensitive information in diagnostic logs. The reported upgrade notes say AWS secret keys and session tokens were written in plaintext when the affected IAM tracing path was enabled.
Other flaws affect Query Console, Amazon S3 connectivity, audit records and deprecated components. CVE-2026-85959 is particularly relevant to incident response because successful logins were not always written to the audit log, which Progress says can hinder the detection and investigation of unauthorized access or credential misuse.
Upgrading changes security behavior and compatibility
MarkLogic 11.3.7 is the corrected release on the long-term support line. MarkLogic 12 users must move to 12.1.0, which is not a security-only 12.0 update and also introduces new features and behavior changes.
Administrators should account for these documented changes:
- Older MarkLogic Content Pump versions can fail against the corrected servers with an XDMP-ISOLATED error. Progress recommends mlcp 11.3.7 or 12.1.0. As an alternative, older versions can use
-restrict_hostsset totrue, with a possible performance cost. - The
/manage/v2/packagesAPI, InfoStudio and OpsDirector have been removed. - XML external-entity processing is disabled by default.
- Amazon S3 connections now default to HTTPS.
- New or rotated ErrorLog.txt and AuditLog.txt files use mode 0640, replacing 0666. Existing files retain their previous permissions until rotation or recreation.
xdmp:eval-in()now requires both xdmp-eval-in and xdmp-eval.- Forest attachment, backup and restore permissions are checked against every forest and database involved.
- Reading Authorization headers requires a new privilege that is not assigned to a built-in role.
- MarkLogic 11.3.7 does not support Amazon Linux 2.
- The Kerberos correction requires a keytab. Without one, MarkLogic records a warning and skips the new check.
Progress’s reported upgrade guidance also calls for reviewing delegated forest and database privileges and auditing roles that hold xdmp-eval-in. Customers should test applications for access changes: the correction for CVE-2026-85954 may remove privileges that users previously possessed because that access was granted incorrectly.
Patch, then check for persistent access
The cited CVE records and upgrade notes do not indicate whether any of the 31 vulnerabilities has been exploited. None was present in CISA’s Known Exploited Vulnerabilities catalog when checked on October 13, 2026, so no KEV remediation deadline applied at that point. That status does not reduce the impact of the privilege-escalation paths in exposed, multi-user or delegated-administration environments.
The reporting also identifies no workaround for organizations unable to upgrade immediately. Operators should prioritize 11.3.7 or 12.1.0, inventory accounts with delegated forest, database, query-execution and management permissions, and review administrator accounts for unauthorized additions.
The available information does not establish that installing the update removes an administrator account previously created through CVE-2026-85947. Where compromise is suspected, patching should therefore be accompanied by a separate review of accounts, roles, credentials and relevant audit data.
