Do Son 
TL;DR
Progress patched 31 MarkLogic Server vulnerabilities in its October 2026 security bulletin. Three flaws score 9.9 on CVSS and can give low-privileged users elevated code execution or full admin control. Fixed releases 12.1 and 11.3.7 are available now.
- Total: 5 CVEs
- Severity: 5 Critical
- Actively exploited: None confirmed
- Highest severity: 9.9 (Critical · CVSSv3) — CVE-2026-85955
- Action: Apply the latest security updates now
Turn Progress CVEs into GitHub Issues automatically — no copy-pasting, no duplicates.
Try Team free for 14 daysNotable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-85955 | 9.9 | Improper privilege management in Progress xdmp:eval-in | 11.3.7, 12.1.0 | Not exploited |
| CVE-2026-85948 | 9.9 | Improper privilege management in Progress Management API | 11.3.7, 12.1.0 | Not exploited |
| CVE-2026-85947 | 9.9 | Improper privilege management in Progress forest operations | 11.3.7, 12.1.0 | Not exploited |
| CVE-2026-85956 | 9.6 | Improper privilege management in Progress backup and restore operations | 11.3.7, 12.1.0 | Not exploited |
| CVE-2026-9191 | 9.6 | Insufficient isolation of user-supplied code in Progress | 11.3.7, 12.1.0 | Not exploited |
Why It Matters
MarkLogic stores sensitive enterprise data, so admin takeover puts that data at risk. The MarkLogic Critical Security Alert Bulletin for October 2026 warns that exploitation could lead to “unauthorized administrative actions, unauthorized access to or modification of data, credential exposure, code execution, service disruption or reduced auditability.”
Detection is also hard. According to Progress, “Affected MarkLogic Server instances exhibit no advance warning and continue to operate normally.” The vendor adds that “the absence of indicators does not establish that exploitation has not occurred.”
How the Attacks Work
Privilege escalation to admin
The most severe MarkLogic Server vulnerabilities come from weak privilege checks. CVE-2026-85955 (CVSS 9.9) lets a user with query access run code with elevated permissions. Similarly, CVE-2026-85948 abuses an injection flaw in a deprecated management API, while CVE-2026-85947 lets a forest-management user create a hidden admin account. Both score 9.9.
Other critical and high-risk issues
- CVE-2026-85956 (CVSS 9.6): delegated database admins could back up or restore data outside their scope.
- CVE-2026-9191 (CVSS 9.6): weak isolation could let attackers hijack an authenticated session.
- Cloud SSRF bugs: two flaws could expose cloud credentials on Azure and Linux hosts.
- SAML and OpsDirector flaws: some could let unauthenticated attackers gain access.
Several fixes also close network-level gaps. Some connections, including Amazon S3 links by default, used cleartext transport. Other outbound links skipped TLS hostname checks. In addition, MarkLogic did not always log successful logins, which makes misuse harder to spot.
Exploitation status
Progress does not report exploitation in the wild. Likewise, no public proof-of-concept has been confirmed.
Affected Versions
- MarkLogic Server 12.0 through 12.0.3
- MarkLogic Server 11.0 through 11.3.6
- Retired releases, including 10.x and earlier, which receive no fixes
Patch and Mitigation Steps
- Upgrade to MarkLogic Server 12.1 or 11.3.7.
- Move retired versions to a supported fixed release.
- Upgrade mlcp clients to match the new server version.
- Review the known incompatibilities notes first, since some fixes change legacy APIs.
- Audit admin accounts for unexpected additions.
Progress Data Cloud customers can relax. Progress confirms they “were patched and are no longer vulnerable to these issues.”
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
