Progress Software Discloses 31 MarkLogic Server Vulnerabilities, Including Five Critical Flaws

Meta Title: MarkLogic Server Vulnerabilities: 31 Flaws and 5 Critical CVEs

Meta Description: Progress Software disclosed 31 MarkLogic Server vulnerabilities, including five critical flaws that could enable privilege escalation, server-side code execution, and unauthorized access.

SEO Keywords: MarkLogic Server vulnerabilities, Progress Software security flaws, MarkLogic CVE-2026, critical database vulnerabilities, privilege escalation, database security, CVE-2026-85947, CVE-2026-85948, cybersecurity news

Progress Releases Security Fixes for 31 MarkLogic Server Flaws

Progress Software has disclosed 31 security vulnerabilities in its MarkLogic Server database platform, including five critical-severity flaws that could allow attackers with certain privileges to gain elevated access or compromise server operations.

The vulnerabilities were published on October 12, 2026. According to Progress, fixes are available in MarkLogic Server 11.3.7 and 12.1.0, released on September 10, 2026.

The affected versions are:

  • MarkLogic 11.x: Upgrade to version 11.3.7.
  • MarkLogic 12.x: Upgrade to version 12.1.0.

MarkLogic 11.3 is the long-term support release line, while version 12 is an innovation release. Customers should review the relevant upgrade notes before deploying the fixes.

Progress has not confirmed whether these newly disclosed vulnerabilities have been exploited in real-world attacks. The published records also do not identify a workaround for organizations that cannot upgrade immediately.

Five Critical Vulnerabilities Could Enable Privilege Escalation

Progress assigned critical severity to five vulnerabilities, with CVSS scores ranging from 9.6 to 9.9 out of 10. The flaws affect different components and configurations, and each has specific prerequisites.

CVE IDCVSS ScorePotential ImpactCVE-2026-859479.9Forest-management privileges could be abused to create a persistent administrator account.CVE-2026-859489.9An XQuery injection flaw in a deprecated Management API path could enable persistent administrative control.CVE-2026-859559.9Certain query-execution privileges could allow elevated server-side code execution.CVE-2026-859569.6Delegated database-administrator privileges could allow unauthorized forest backup or restoration operations.CVE-2026-91919.6Certain REST and XDBC evaluation paths could permit unauthorized actions or compromise an authenticated session.

These vulnerabilities do not all provide unauthenticated access. According to Progress's CVE records, the critical flaws require existing privileges or the ability to execute code through particular server functionality.

The vulnerabilities nevertheless create significant risks for environments where permissions are overly broad or administrative capabilities are delegated without sufficient restrictions.

Additional High-Severity Vulnerabilities Affect Authentication and Cloud Security

Beyond the five critical flaws, Progress rated 24 vulnerabilities as high severity and two as medium severity.

Several affect specific authentication mechanisms, cloud environments, legacy features, and administrative interfaces.

SAML and OAuth Authentication

Some vulnerabilities affect deployments using SAML or OAuth authentication. These issues could allow invalid authentication assertions or tokens to be accepted under affected configurations.

The fixes introduce additional validation checks, including issuer and audience verification for relevant OAuth configurations.

Kerberos Authentication

A vulnerability affecting certain password-based Kerberos configurations could allow an attacker positioned on the network to impersonate the Kerberos authentication service.

Organizations using the affected authentication setup should review the applicable upgrade requirements.

Cloud Credential Exposure

Two vulnerabilities affect cloud-hosted deployments:

  • CVE-2026-85951: Affects Azure deployments and could allow an authenticated attacker to access internal cloud services and obtain cloud credentials.
  • CVE-2026-85952: Affects Linux-based cloud deployments and could expose access to internal cloud services and cloud credentials.

Other flaws could cause security-sensitive information, including AWS secret keys and session tokens, to be written in plaintext to diagnostic logs under affected configurations.

Query Console and Legacy Components

Additional vulnerabilities affect the MarkLogic Query Console and deprecated components such as OpsDirector and InfoStudio.

Depending on the vulnerability and configuration, these issues could expose server files, enable server-side code execution under a logged-in user's permissions, or allow unauthorized requests to internal services.

The release also addresses memory-safety issues, cross-site scripting, HTTP response splitting, TLS hostname verification inconsistencies, and cleartext cluster-management traffic in version 12.x.

Why Previous Security Updates Are Not Enough

This disclosure follows an earlier batch of 10 MarkLogic vulnerabilities published in August 2026, seven of which were rated critical.

The earlier vulnerabilities were addressed in MarkLogic 11.3.6 and 12.0.3. However, those releases are also affected by the newly disclosed flaws.

Organizations that installed the August updates should therefore verify their current versions and upgrade to the latest fixed release applicable to their deployment.

Important Changes Included in the Security Updates

The latest releases introduce several security improvements and compatibility changes that administrators should review before upgrading.

  • Stricter XML processing: XML external entity processing is disabled by default.
  • Secure Amazon S3 connections: S3 connections now default to HTTPS.
  • Improved log-file permissions: Newly created or rotated error and audit logs use more restrictive permissions.
  • Tighter privilege checks: Certain evaluation, forest attachment, backup, and restoration operations require additional authorization checks.
  • Protected stored secrets: FlexRep configuration responses no longer return stored passwords, client private keys, or passphrases.
  • Removed legacy features: The /manage/v2/packages API, InfoStudio, and OpsDirector have been removed.

Some changes may affect existing applications, integrations, and automation. For example, older versions of MarkLogic Content Pump (mlcp) may fail against the new releases unless updated or run with the documented compatibility settings.

Administrators should consult the official upgrade notes and known incompatibilities before applying the update in production.

Organizations using MarkLogic Server should take the following steps:

  1. Identify affected versions: Inventory all MarkLogic 11.x and 12.x deployments.
  2. Upgrade to fixed releases: Move MarkLogic 11.x to 11.3.7 and MarkLogic 12.x to 12.1.0, following the vendor's upgrade instructions.
  3. Audit privileged accounts: Review forest-management and delegated database-administrator permissions.
  4. Review evaluation privileges: Audit roles assigned the xdmp-eval-in privilege and other sensitive execution capabilities.
  5. Inspect authentication configurations: Review SAML, OAuth, and Kerberos configurations where applicable.
  6. Protect cloud credentials: Check diagnostic logging settings and review access to cloud identity credentials.
  7. Validate application compatibility: Test integrations, mlcp workflows, and administrative tools before production deployment.
  8. Review audit logs: Investigate suspicious administrative changes or unexpected access where logs are available.

The source records do not establish that these vulnerabilities are being actively exploited, so organizations should avoid assuming a compromise solely because an affected version is installed.

Key Takeaway

The disclosure of 31 MarkLogic Server vulnerabilities highlights the importance of timely patching and carefully managed database privileges. The five critical flaws could have serious consequences in affected environments, particularly where users or applications hold excessive permissions.

Organizations should prioritize upgrading to the fixed versions, reviewing delegated administrative access, and validating authentication and cloud-security configurations.

Official References: