Progress Software has disclosed 31 security vulnerabilities affecting MarkLogic Server, including critical flaws that could allow accounts with certain delegated management privileges to gain persistent administrator control of affected systems. The vulnerabilities were published on October 12, with five issues receiving critical severity ratings. Security fixes have already been released through MarkLogic 11.3.7 and MarkLogic 12.1.0, and customers using affected versions are advised to upgrade to the latest supported releases. The disclosed issues highlight the importance of maintaining updated enterprise database environments, particularly for organizations relying on MarkLogic for storing and managing critical business information.
According to Progress Software’s security records, two of the critical vulnerabilities involve scenarios where accounts with limited management permissions could potentially obtain broader administrative capabilities. One issue, identified as CVE 2026 85947, affects forest management privileges and could allow the creation of a persistent administrator account, potentially providing complete control over the server. Another vulnerability, CVE 2026 85948, involves a deprecated Management API path where an XQuery injection issue could enable persistent administrative access for accounts with manage user level privileges. Additional critical vulnerabilities include CVE 2026 85955, which could allow server side code execution with elevated permissions, CVE 2026 85956, which involves delegated database administrator privileges and potential access to security sensitive data through backup and restore operations, and CVE 2026 9191, which affects certain REST and XDBC evaluation paths. Progress has stated that attackers would require existing privileges or a method to execute code on the server for these critical issues to be triggered.
The company has clarified that the available records and upgrade documentation do not indicate whether any of the 31 vulnerabilities have been exploited in active attacks. None of the disclosed issues were listed in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog when checked on October 13. Progress has also not provided a temporary workaround for organizations that are unable to immediately upgrade. The company recommends customers review upgrade notes before deployment, as the security updates introduce several changes that could affect existing applications, tools, and automation processes. These include updates related to privileges, authentication behavior, security logging, cloud configurations, and deprecated components. MarkLogic 11.3.7 is part of the long term support release line, while MarkLogic 12.1.0 introduces fixes alongside additional platform improvements.
Beyond the five critical issues, Progress disclosed 24 high severity vulnerabilities and two medium severity flaws affecting different configurations and features. Some vulnerabilities are related to specific environments, including SAML authentication, OAuth configurations, password based Kerberos setups, cloud deployments, diagnostic logging, Amazon S3 connections, and Query Console functionality. The company has also introduced security related changes, including stronger default settings for XML external entity processing, HTTPS based S3 connections, updated file permissions for security logs, and additional privilege checks for sensitive operations. Several changes may require organizations to review existing configurations before completing upgrades, particularly where legacy tools or custom integrations are involved. Progress has recommended that customers review compatibility information for MarkLogic 11.3.7 and 12.1.0 before applying updates.
The latest disclosure represents the second major batch of MarkLogic security issues reported by Progress in recent months. In August, the company disclosed 10 additional vulnerabilities affecting the database platform, including several critical issues. Security researchers have contributed to multiple MarkLogic vulnerability reports through responsible disclosure channels, including Bugcrowd. The latest updates reinforce the need for organizations using enterprise database platforms to maintain regular patching practices, review access privileges, and monitor system configurations. While there is no confirmed indication that the newly disclosed flaws have been exploited, timely installation of security updates remains an important step for reducing potential risks associated with privilege escalation and unauthorized system access.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
