MarkLogic patches 31 flaws, 5 critical: privileged users can seize admin
Progress disclosed 31 MarkLogic flaws on Oct 12, five critical (CVSS up to 9.9). Each escalates an already-privileged user to persistent admin or code execution. Fixed in 11.3.7 and 12.1.0.
Progress disclosed 31 vulnerabilities in MarkLogic Server on October 12, 2026, five of them critical with CVSS scores up to 9.9. The common thread: each critical flaw takes a user who already holds some privilege and escalates them to a persistent administrator account or server-side code execution. Fixes shipped on September 10 — a month before the public disclosure — in MarkLogic 11.3.7 and 12.1.0.
Progress's CVE records are the primary source; each ID resolves at cve.org. There is no single consolidated vendor advisory URL — the fixes are documented in the 11.3.7 and 12.x release notes.
The five critical flaws
| CVE | CVSS | Attacker needs | Impact |
|---|---|---|---|
| CVE-2026-85947 | 9.9 | Forest-management privileges | Create a persistent admin account; possibly full server control |
| CVE-2026-85948 | 9.9 | Manage-user privileges | Persistent admin via XQuery injection in a deprecated Management API path |
| CVE-2026-85955 | 9.9 | Query access plus the xdmp-eval-in privilege | Run server-side code with elevated permissions |
| CVE-2026-85956 | 9.6 | Delegated database-admin privileges | Back up or restore forests outside its own database, exposing security-critical data |
| CVE-2026-9191 | 9.6 | Code execution via certain REST/XDBC paths | Unauthorized actions or compromise of an authenticated session |
The highest non-critical bug, CVE-2026-85954 (CVSS 8.6), lets an attacker gain more privileges than granted by passing values to certain XQuery functions. Progress credits researchers "rexnets" (CVE-2026-85947, -85948, -85956) and "WaltWhitehat" (CVE-2026-9191).
The precondition that matters
None of the five critical flaws is a pre-auth remote takeover. Each requires the attacker to already hold a MarkLogic privilege — forest management, user management, delegated DB admin — or a way to run code on the server. That makes this an insider-and-lateral-movement problem: a compromised low-tier service account or a over-scoped delegated admin becomes a full-server compromise. On a database holding regulated data, "delegated admin can restore any forest" (CVE-2026-85956) is the line that should make you audit who holds what.
Exploitation status
Progress's records and upgrade notes do not state that any of the 31 flaws has been exploited. None appeared in CISA's Known Exploited Vulnerabilities catalog when checked on October 13. No public PoC is referenced.
Action checklist
- Upgrade now. 11.x → 11.3.7 (the LTS line); 12.x → 12.1.0 (there is no patched 12.0 release). Note that 11.3.6 and 12.0.3 — the fixes for August's flaws — are themselves affected by this batch.
- Audit privilege grants before you assume patching is enough: who holds forest-management, manage-user,
xdmp-eval-in, and delegated database-admin roles? Revoke what isn't needed. - Check the audit log. CVE-2026-85959 in the same batch means successful logins were not always written to the audit log — don't treat a clean log as proof of no access.
- Re-run integration tests after upgrade; Progress flags upgrade incompatibilities for both 11.3.7 and 12.1.0.
Context
This is MarkLogic's second large disclosure of 2026: Progress published 10 flaws on August 5, with fixes dated July. The fix-to-disclosure gap this time was 32 days — defenders had a month, but only if they were watching release notes rather than waiting for a CVE feed. For a database that routinely sits behind applications holding sensitive records, the standing lesson is that the dangerous bugs here aren't the ones an anonymous attacker can reach; they're the ones your own over-provisioned accounts can.