MarkLogic Server Security Bulletin Patches 10 Vulnerabilities, With CVSS Scores Up to 9.9

TL;DR

Progress released an August 2026 bulletin for MarkLogic Server. It fixes ten MarkLogic Server vulnerabilities, several rated critical. The worst carry a CVSS score of 9.9. Progress urges all customers to upgrade as soon as possible.

Notable CVEs

Why it matters

MarkLogic stores enterprise data across many organizations. These MarkLogic Server vulnerabilities span privilege escalation, authentication bypass, and more. Together they could give an attacker full control of an affected instance.

How the attacks work

The bulletin covers several distinct weaknesses. Each targets a different part of the server.

Authentication bypass

CVE-2026-9192 lets an unauthenticated attacker skip password checks on the ODBC App Server. It scores 9.8. CVE-2026-7557 abuses weak SAML signature checks to impersonate any user. It scores 9.1.

Privilege escalation

Three flaws let low-privileged users reach administrator rights. CVE-2026-7329, CVE-2026-8709, and CVE-2026-9193 all score 9.9. Each exploits a different REST or Hadoop path.

Web and request-handling flaws

Other issues include HTTP request smuggling, cross-site scripting, CSRF, and SSRF. The SSRF flaw can expose cloud credentials from instance metadata.

Exploitation status

Progress has not reported any in-the-wild exploitation. No public proof-of-concept has been confirmed for these flaws.

Affected versions

The bulletin affects MarkLogic Server 12.0.0 through 12.0.1 and 11.0.0 through 11.3.4. Version 10.x and earlier are also affected.

Patch and mitigation

Upgrade now. Progress fixed the flaws in MarkLogic Server 12.0.3 and 11.3.6. Retired releases should move to a supported, fixed build. Full details appear in the MarkLogic Critical Security Alert Bulletin for August 2026.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.