Progress Software published 31 security flaws in its MarkLogic Server database on October 12, 2026. Five are rated critical, and three of those score 9.9 out of 10. The fixes already exist: they shipped in MarkLogic 11.3.7 and 12.1.0 on September 10. Anyone still on the August patch releases, 11.3.6 or 12.0.3, is exposed.
The 31 flaws at a glance
The National Vulnerability Database lists all 31 records, filed by Progress itself. It counts 5 critical, 24 high and 2 medium flaws. CVSS is the standard 0-10 severity score for software flaws.
| CVE | Score | What an attacker needs | What it allows |
|---|---|---|---|
| CVE-2026-85947 | 9.9 | Forest-management privileges | Create a persistent administrator account |
| CVE-2026-85948 | 9.9 | Manage-user-level privileges | Persistent admin control, through code injection in an old Management API path |
| CVE-2026-85955 | 9.9 | Query access, without the evaluation privilege | Run server-side code with higher permissions |
| CVE-2026-85956 | 9.6 | Delegated database-administrator rights | Back up or restore data outside its own database |
| CVE-2026-9191 | 9.6 | Code run through REST or XDBC evaluation paths | Reach other users' request and session data |
A forest is MarkLogic's name for a unit of stored data. XDBC is a MarkLogic interface that client programs use to send queries.
Every critical flaw starts with some access
None of the five critical flaws works for a stranger with no account. The Hacker News notes that each one needs an existing privilege or a way to run code on the server. That is why the NVD records mark them as needing low privileges.
The pattern is about delegation. MarkLogic lets an administrator hand narrow powers to other accounts, such as managing one forest or one set of users. Several of these flaws let such an account climb from that narrow role to full control. NVD files them under CWE-269, the category for improper privilege management.
The Hacker News credits four of the critical flaws to researchers on the Bugcrowd bug-bounty platform. The highest-rated non-critical bug, CVE-2026-85954 at 8.6, also hands out more privilege than an admin granted. Another, CVE-2026-85959, means successful logins are not always written to the audit log.
As of October 13, none of the flaws was in the US government's catalog of exploited vulnerabilities. The CVE records do not say whether any have been used in attacks.
Fixed in September, disclosed in October
The MarkLogic 12 release notes date 12.1.0 to September 10, 2026. The 11 release notes describe 11.3.7 as "a patch and security update to the MarkLogic 11.3 LTS release." Both pages were updated on October 12, the day the CVEs went public.
| Branch | Vulnerable | Fixed in |
|---|---|---|
| MarkLogic 11 | Before 11.3.7 | 11.3.7 |
| MarkLogic 12 | Before 12.1.0 | 12.1.0 (no patched 12.0 release) |
This is the second batch in 68 days. According to The Hacker News, an August batch fixed 10 flaws, 7 of them critical, in 11.3.6 and 12.0.3. Those releases do not cover the new flaws.
What changes when you upgrade
Some fixes change behavior that working code may depend on. The release notes say CVE-2026-9191 now isolates code run through /v1/eval, /eval, SPARQL, SQL, Optic, GraphQL and REST patch requests. On those paths, functions that touch the HTTP request, response or session now fail with an XDMP-ISOLATED error. Code run through /v1/invoke stays unisolated by design.
The Hacker News lists three more upgrade notes:
- Older versions of mlcp, MarkLogic's bulk-loading tool, fail with
XDMP-ISOLATED. - The Kerberos login fix needs a keytab file.
- Existing log files keep their old permissions until they are rotated.
Progress also warns that accounts may lose access. In its words, "you may no longer have privileges that you previously had access to, because that access was incorrect."
What this means for developers
- Check your version first. Anything below 11.3.7 or 12.1.0 is affected. On the 12.0 line there is no patch, so the fix means moving to 12.1.0.
- Do not trust an August upgrade. Teams that installed 11.3.6 or 12.0.3 for the last advisory are still exposed to all 31 flaws.
-
Audit delegated roles before upgrading. The Hacker News says Progress lists no workaround, but advises reviewing who holds delegated forest and database rights, and which roles hold
xdmp-eval-in. Trim those first. -
Test eval-based code in staging. Apps that call
/v1/evalor REST patch and read request or session data will start throwingXDMP-ISOLATED. Upgrade mlcp at the same time. - Plan for lost permissions. If a service account breaks after the upgrade, it may have been relying on access it should never have had. Grant it back deliberately, not wholesale.
- Mind the platform change. The 11.3.7 notes drop Amazon Linux 2, which reached end of life on June 30, 2026. Hosts still on it need Amazon Linux 2023 first.
This article was first published on Tech AI Wire.
Also available in
Deutsch · 日本語 · Français · Español · Português
Sources
- Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control - The Hacker News
- CVE-2026-85947 Detail - NIST National Vulnerability Database
- Release notes - Progress MarkLogic Server 12 documentation
Top comments (0)