31 MarkLogic Server Flaws Disclosed; Critical Bugs Could Grant Admin Control
Summary
Progress disclosed 31 MarkLogic Server flaws, including critical vulnerabilities that could let users with limited privileges gain administrator control. Fixes are available in versions 11.3.7 and 12.1.0; exploitation has not been confirmed.
Key points
- Progress disclosed 31 flaws on October 12 and rated five critical; three received CVSS 9.9 and two 9.6.
- Two critical flaws could enable accounts with limited management privileges to take administrator control. Attackers must already have a privilege or a way to run code on the server.
- Fixes are available in MarkLogic 11.3.7 and 12.1.0. MarkLogic 12.0 has no patched release, and versions 11.3.6 and 12.0.3 are affected.
- Progress's records do not say whether any of the flaws have been exploited; none was listed in CISA's Known Exploited Vulnerabilities catalog as of October 13.
- Progress recommends reviewing delegated forest and database privileges and auditing roles holding xdmp-eval before upgrading. No workaround is listed for customers unable to upgrade.
- Other flaws include privilege escalation, memory-safety issues, cross-site scripting, HTTP response splitting, TLS hostname-check inconsistencies, and cleartext cluster-management traffic on 12.x.
- CVE-2026-85959 could cause successful logins to go unrecorded in audit logs, limiting detection and investigation of unauthorized access or credential misuse.
Article Details
- Vulnerability Types
- Privilege escalation
- Improper authorization of forest attachment
- Memory-safety flaws
- Cross-site scripting
- HTTP response splitting
- Inconsistent TLS hostname checks
- Cleartext cluster-management traffic
- Audit logging failure
- Password-verification bypass
- Severity
- Five newly disclosed flaws were rated critical: three scored 9.9 and two scored 9.6. Of the remaining flaws, 24 were rated high and two medium. The article also reports that CVE-2026-9192 from the August batch scored 9.8.
- Affected Versions
- MarkLogic 11.3 releases before 11.3.7
- MarkLogic 12.0.x; no patched 12.0 release is available
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-85947The fix for CVE-2026-85947 shows which accounts are at issue. A "forest-scoped administrative grant" is no longer enough on its own to attach a forest to a database of the account's choosing, the upgrade notes say. TheyCVE-2026-85948of the five through Bugcrowd. A researcher using the handle rexnets is credited with CVE-2026-85947, CVE-2026-85948, and CVE-2026-85956, and another using the handle WaltWhitehat is credited with CVE-2026-9191.CVE-2026-85954Progress scored 24 of the remaining flaws high and two medium. The highest, CVE-2026-85954, at 8.6, could allow an attacker to gain more privileges than granted by passing values to certain XQuery functions.CVE-2026-85956Bugcrowd. A researcher using the handle rexnets is credited with CVE-2026-85947, CVE-2026-85948, and CVE-2026-85956, and another using the handle WaltWhitehat is credited with CVE-2026-9191.CVE-2026-85959Another flaw, CVE-2026-85959, meant successful logins were not always recorded in the audit log. Progress says that could limit a customer's ability to detect and investigate unauthorized access or credential misuse.CVE-2026-9191CVE-2026-85948, and CVE-2026-85956, and another using the handle WaltWhitehat is credited with CVE-2026-9191.CVE-2026-9192disclosed for MarkLogic in 68 days. On August 5, it published 10, seven of them scored critical. One, CVE-2026-9192, was scored 9.8 and allows an unauthenticated remote attacker to bypass password verification on the
People
Vendors
Products
MarkLogicTwo of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.MarkLogic ServerTwo of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.