Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.

Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0 .

Affected releases, and the release that fixes each:

MarkLogic 11.3 is the long-term support (LTS) line. The 12 line, which Progress calls an innovation release, has no patched 12.0 release. Its fix is 12.1.0, which also adds new features.

Installing the fixes for the 10 MarkLogic flaws Progress disclosed in August is not enough. Those fixes arrived in 11.3.6 and 12.0.3, and both releases are affected by the new flaws.

Progress's CVE records and its upgrade notes for the two releases do not say whether any of the 31 flaws has been used in attacks. None was in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog when The Hacker News checked on October 13.

The same records and notes list no workaround for customers who cannot upgrade yet.

Progress scored three of the five critical flaws 9.9 out of 10 on the CVSS scale and the other two 9.6. For each one, the attacker must already have a privilege or a way to run code on the server, according to the company's CVE records.

Two of them involve forests. In MarkLogic, a forest is a collection of documents that is attached to a database.

The fix for CVE-2026-85947 shows which accounts are at issue. A "forest-scoped administrative grant" is no longer enough on its own to attach a forest to a database of the account's choosing, the upgrade notes say. They also tell customers to review delegated forest and database privilege assignments before upgrading, and to audit the roles that hold xdmp-eval-in.

Outside researchers reported four of the five through Bugcrowd. A researcher using the handle rexnets is credited with CVE-2026-85947, CVE-2026-85948, and CVE-2026-85956, and another using the handle WaltWhitehat is credited with CVE-2026-9191.

Progress scored 24 of the remaining flaws high and two medium. The highest, CVE-2026-85954, at 8.6, could allow an attacker to gain more privileges than granted by passing values to certain XQuery functions.

Several of the others apply only where a named feature or platform is in use:

The rest include three memory-safety flaws, a cross-site scripting flaw, HTTP response splitting in Query Console, inconsistent TLS hostname checks on some outbound connections, and cleartext cluster-management traffic on 12.x.

Progress tells customers to read its upgrade notes, the known incompatibilities for 11.3.7 and those for 12.1.0 , before upgrading. The 11.3.7 notes list behavior changes tied to 22 of the flaws, and the 12.1.0 notes to 21.

Changes that can break existing code, tools, or automation include:

On the fix for CVE-2026-85954, the notes warn: "As a result, you may no longer have privileges that you previously had access to, because that access was incorrect."

Some problems remain after the upgrade. Existing ErrorLog.txt and AuditLog.txt files keep their old permissions until they are rotated or recreated. The Kerberos fix needs a keytab, and without one, the server logs a warning and skips the new check.

Another flaw, CVE-2026-85959, meant successful logins were not always recorded in the audit log. Progress says that could limit a customer's ability to detect and investigate unauthorized access or credential misuse.

The CVE records and upgrade notes do not say whether upgrading removes an administrator account created through CVE-2026-85947 before the upgrade.

The 31 flaws are the second batch Progress has disclosed for MarkLogic in 68 days. On August 5, it published 10, seven of them scored critical. One, CVE-2026-9192 , was scored 9.8 and allows an unauthenticated remote attacker to bypass password verification on the ODBC App Server, according to its CVE record.

Both times the fixes shipped first. The August flaws were fixed in releases dated July 1 and July 6, 35 and 30 days before their CVE records appeared. This time the gap was 32 days.

A search by The Hacker News of the U.S. National Vulnerability Database (NVD) on October 13 returned 49 CVE records that mention MarkLogic, 41 of them from these two batches. The other eight, from 2017 and 2018, are for Antenna House DMC HTMLFilter, a third-party component used by MarkLogic 8.0-6. Earlier MarkLogic releases also carried security fixes: the release notes for 11.3.1, 11.3.2 and 11.3.4 each mention "patches for security vulnerabilities" and name no CVE in the server's own code.