Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.
Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0.
Affected releases, and the release that fixes each:
- MarkLogic 11.x before 11.3.7: upgrade to 11.3.7
- MarkLogic 12.x before 12.1.0: upgrade to 12.1.0
MarkLogic 11.3 is the long-term support (LTS) line. The 12 line, which Progress calls an innovation release, has no patched 12.0 release. Its fix is 12.1.0, which also adds new features.
Installing the fixes for the 10 MarkLogic flaws Progress disclosed in August is not enough. Those fixes arrived in 11.3.6 and 12.0.3, and both releases are affected by the new flaws.
Progress's CVE records and its upgrade notes for the two releases do not say whether any of the 31 flaws has been used in attacks. None was in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog when The Hacker News checked on October 13.
The same records and notes list no workaround for customers who cannot upgrade yet.
What the Critical Flaws Allow
Progress scored three of the five critical flaws 9.9 out of 10 on the CVSS scale and the other two 9.6. For each one, the attacker must already have a privilege or a way to run code on the server, according to the company's CVE records.
Two of them involve forests. In MarkLogic, a forest is a collection of documents that is attached to a database.
| CVE | Score | What the Attacker Needs | What It Could Allow |
|---|---|---|---|
| CVE-2026-85947 | 9.9 | Forest-management privileges | Create a persistent administrator account, potentially giving complete administrative control of the server |
| CVE-2026-85948 | 9.9 | Manage-user-level privileges | Gain persistent administrative control, through an XQuery injection flaw in a deprecated Management API path |
| CVE-2026-85955 | 9.9 |
Query-execution access and the xdmp-eval-in privilege
|
Run server-side code with elevated permissions |
| CVE-2026-85956 | 9.6 | Delegated database-administrator privileges | Back up or restore forests outside its own database, allowing access to or changes to what Progress calls "security-critical data" |
| CVE-2026-9191 | 9.6 | The ability to run code through certain REST and XDBC evaluation paths | Perform unauthorized actions or compromise an authenticated session |
The fix for CVE-2026-85947 shows which accounts are at issue. A "forest-scoped administrative grant" is no longer enough on its own to attach a forest to a database of the account's choosing, the upgrade notes say. They also tell customers to review delegated forest and database privilege assignments before upgrading, and to audit the roles that hold xdmp-eval-in.
Outside researchers reported four of the five through Bugcrowd. A researcher using the handle rexnets is credited with CVE-2026-85947, CVE-2026-85948, and CVE-2026-85956, and another using the handle WaltWhitehat is credited with CVE-2026-9191.
Flaws That Depend on Configuration
Progress scored 24 of the remaining flaws high and two medium. The highest, CVE-2026-85954, at 8.6, could allow an attacker to gain more privileges than granted by passing values to certain XQuery functions.
Several of the others apply only where a named feature or platform is in use:
- SAML: In deployments that use SAML authentication, an unauthenticated remote attacker could make the server accept an assertion it should reject (CVE-2026-85962). On 11.x, the SAML parser could also process external DTDs or entities (CVE-2026-85957).
- OAuth: An attacker could use a token that the server should not accept (CVE-2026-85958). The fix adds issuer and audience checks for Ping Identity and other OAuth configurations.
- Password-based Kerberos: In certain configurations, an attacker positioned on the network could impersonate the Kerberos authentication service (CVE-2026-85972).
- Cloud hosting: An authenticated attacker could access internal cloud services and obtain cloud credentials on Azure (CVE-2026-85951) and on Linux-based cloud deployments (CVE-2026-85952).
- Diagnostic logs: Under certain configurations, the server could write security-sensitive information to diagnostic logs (CVE-2026-85949 and, on Azure, CVE-2026-85961). AWS secret keys and session tokens were written in plaintext when the affected IAM trace path was enabled, the upgrade notes say.
- Amazon S3: Connections to S3 could use cleartext by default (CVE-2026-85975).
- Query Console: A remote attacker who gets a logged-in Query Console user to open a malicious page could run server-side code with that user's permissions (CVE-2026-85960). An authenticated Query Console user could read arbitrary server files (CVE-2026-85964).
- Legacy components: OpsDirector, a deprecated feature, could let an unauthenticated remote attacker make requests to internal services or forge trusted requests (CVE-2026-85963). Legacy InfoStudio modules could give access to server files (CVE-2026-85953).
The rest include three memory-safety flaws, a cross-site scripting flaw, HTTP response splitting in Query Console, inconsistent TLS hostname checks on some outbound connections, and cleartext cluster-management traffic on 12.x.
What the Upgrade Changes
Progress tells customers to read its upgrade notes, the known incompatibilities for 11.3.7 and those for 12.1.0, before upgrading. The 11.3.7 notes list behavior changes tied to 22 of the flaws, and the 12.1.0 notes to 21.
Changes that can break existing code, tools, or automation include:
- mlcp: Older versions of MarkLogic Content Pump (mlcp) fail against the new releases with an XDMP-ISOLATED error. Progress recommends mlcp 11.3.7 or 12.1.0. Older versions can run with -restrict_hosts set to true, which can reduce performance.
- Removed features: The /manage/v2/packages API, InfoStudio, and OpsDirector are removed.
- New defaults: XML external entity processing is off by default, S3 connections default to HTTPS, and new and rotated ErrorLog.txt and AuditLog.txt files are created with mode 0640 instead of 0666.
- Privileges: xdmp:eval-in() now needs both the xdmp-eval-in and xdmp-eval privileges. Reading Authorization headers needs a new privilege that no built-in role holds. Forest attachment, backup and restore are checked against every forest and database they touch.
- Stored secrets: FlexRep configuration responses no longer return stored passwords, client private keys or passphrases.
- Platform: MarkLogic 11.3.7 does not support Amazon Linux 2.
- Name conflicts: The upgrade can fail if the cluster already has a role, user or privilege with one of five names used by a new ticket system. The names are in the upgrade notes.
- Changes with no CVE attached: Both releases limit XML entity expansion and drop weak TLS ciphers from the defaults. On 12.1.0, Optic fragment queries return only document fragments by default.
On the fix for CVE-2026-85954, the notes warn: "As a result, you may no longer have privileges that you previously had access to, because that access was incorrect."
Some problems remain after the upgrade. Existing ErrorLog.txt and AuditLog.txt files keep their old permissions until they are rotated or recreated. The Kerberos fix needs a keytab, and without one, the server logs a warning and skips the new check.
Another flaw, CVE-2026-85959, meant successful logins were not always recorded in the audit log. Progress says that could limit a customer's ability to detect and investigate unauthorized access or credential misuse.
The CVE records and upgrade notes do not say whether upgrading removes an administrator account created through CVE-2026-85947 before the upgrade.
Second Batch Since August
The 31 flaws are the second batch Progress has disclosed for MarkLogic in 68 days. On August 5, it published 10, seven of them scored critical. One, CVE-2026-9192, was scored 9.8 and allows an unauthenticated remote attacker to bypass password verification on the ODBC App Server, according to its CVE record.
Both times the fixes shipped first. The August flaws were fixed in releases dated July 1 and July 6, 35 and 30 days before their CVE records appeared. This time the gap was 32 days.
A search by The Hacker News of the U.S. National Vulnerability Database (NVD) on October 13 returned 49 CVE records that mention MarkLogic, 41 of them from these two batches. The other eight, from 2017 and 2018, are for Antenna House DMC HTMLFilter, a third-party component used by MarkLogic 8.0-6. Earlier MarkLogic releases also carried security fixes: the release notes for 11.3.1, 11.3.2 and 11.3.4 each mention "patches for security vulnerabilities" and name no CVE in the server's own code.
