Progress discloses 31 MarkLogic flaws, five critical, including admin takeover bugs

Progress Software has disclosed 31 vulnerabilities in its MarkLogic Server database, five of them rated critical, that could let an account holding only some management privileges take full administrator control of the server, The Hacker News reported. The CVE records were published on October 12, 2026, although fixed releases have been available since September 10. It is the second large batch of MarkLogic flaws in 68 days.

What happened

According to The Hacker News, the batch includes five critical, 24 high-severity and two medium-severity flaws. Progress's CVE records and upgrade notes do not say whether any of them has been exploited, and none was in CISA's Known Exploited Vulnerabilities catalog when the publication checked on October 13. No workarounds are listed for customers who cannot upgrade.

The fixes ship in MarkLogic 11.3.7 for the 11.x long-term support line and 12.1.0 for the 12.x innovation line. There is no patched 12.0 release, so 12.0.x users must move to 12.1.0. The August fixes, 11.3.6 and 12.0.3, are affected by the new flaws.

Technical details

The two most serious issues, rated CVSS 9.9, let delegated administrators escalate. CVE-2026-85947 lets an account with forest-management privileges create a persistent administrator account, while CVE-2026-85948 abuses an XQuery injection flaw in a deprecated Management API path from an account with user-management privileges. The other critical bugs are CVE-2026-85955 (9.9), which allows elevated server-side code execution for accounts with the xdmp-eval-in privilege; CVE-2026-85956 (9.6), which lets a delegated database administrator back up or restore forests outside its own database; and CVE-2026-9191 (9.6), which affects certain REST and XDBC evaluation paths. Outside researchers reported four of the five through Bugcrowd.

Several other flaws depend on configuration. The Hacker News said an unauthenticated remote attacker could get the server to accept a SAML assertion it should reject (CVE-2026-85962), OAuth tokens could be wrongly accepted (CVE-2026-85958), and diagnostic logging could store AWS secret keys and session tokens in plaintext when a specific IAM trace path was enabled. CVE-2026-85959 meant successful logins were not always written to the audit log, which could hinder detection.

Who is affected

Organizations running self-managed MarkLogic Server below 11.3.7 or 12.1.0 are affected, especially those that delegate forest, database or user administration to non-admin accounts. The records do not say whether upgrading removes an administrator account already created through CVE-2026-85947.

What to do

Upgrade to 11.3.7 or 12.1.0. Progress's notes advise reviewing delegated forest and database privileges and auditing roles that hold xdmp-eval-in before upgrading. Plan for compatibility changes: older mlcp versions fail against the new releases, the /manage/v2/packages API, InfoStudio and OpsDirector are removed, and the upgrade can fail if the cluster already has a role, user or privilege with one of five names used by a new ticket system. Administrators should also review the list of admin accounts for entries they did not create.