Skip to content
Today
Sections

Security Independently confirmed2 publishers 2 min read Published

Installing MarkLogic's August fixes leaves 31 newer flaws open

Progress Software published 31 MarkLogic Server flaws on October 12, five of them critical. The 11.3.6 and 12.0.3 releases that fixed August's 10 flaws are affected. Fixes are in 11.3.7 and 12.1.0.

The Watch · Security desk

Send a correction

Illustration accompanying Installing MarkLogic's August fixes leaves 31 newer flaws open
Generated illustration
Critical MarkLogic flaws score up to 9.9 of 10 Severity Progress gave the 31 MarkLogic Server flaws it published on October 12, with CVSS scores from its CVE records.

Progress scored five of the 31 flaws critical. Three of those critical flaws score 9.9 out of 10 on the CVSS scale. Progress scored 24 of the remaining flaws high.

Critical MarkLogic flaws score up to 9.9 of 10
FigureValueNoteClaim
Flaws Progress scored critical, of 315 flaws1
Three critical flaws' CVSS9.9 out of 108
Other flaws scored high24 flaws12

What happened

  • Two of the 31 flaws could let an account holding only some management privileges take administrator control of the server, Progress says.
  • Fixes have been available since September 10, 32 days before Progress published the 31 flaws on October 12.
  • Progress's records do not say whether any flaw has been used in attacks, and none was in CISA's Known Exploited Vulnerabilities catalog on October 13.

Why it matters

  • Who's exposed exposure Accounts holding a forest-scoped administrative grant are the ones at issue. Before the fix, that grant alone was enough to attach a forest to a database of the account's choosing.
  • What it costs cost Customers on 12.0.3 have no patched 12.0 release to move to. Their fix is 12.1.0, which also adds new features, so the security upgrade comes with a feature release to test.
  • What it limits constraint Neither the CVE records nor the upgrade notes include a workaround for servers that cannot upgrade yet.
  • Who has to decide decision The notes ask for a review of delegated forest and database privilege assignments, and an audit of roles holding xdmp-eval-in, before upgrading.

The critical scores sit on flaws that need a foothold. Progress's CVE records show that each of the five requires an attacker who already holds a privilege or can already execute code on the server [8]. Two others are reachable without authentication, and neither is among the critical five [15]. CVE-2026-85962 lets an unauthenticated remote attacker make the server accept a SAML assertion it should reject, but only in deployments that use SAML authentication [13]. CVE-2026-85963 lets an unauthenticated remote attacker make requests to internal services or forge trusted requests through OpsDirector, a deprecated feature [14]. A server without SAML authentication is outside the first [13].

Of the 26 flaws below critical, 24 are high and two are medium, led by CVE-2026-85954 at 8.6 [18][12]. Others depend on a user action or a setting. CVE-2026-85960 requires a logged-in Query Console user to open a malicious page, after which the attacker can run server-side code with that user's permissions [16]. Turning on the affected IAM trace path left AWS secret keys and session tokens in plaintext, according to the upgrade notes [17].

Four of the five critical flaws were reported by outside researchers via Bugcrowd. Credit for CVE-2026-85947, CVE-2026-85948 and CVE-2026-85956 goes to a researcher known as rexnets, and for CVE-2026-9191 to one known as WaltWhitehat [11]. The report did not identify the two CVEs that carry the delegated-manager escalation. Together with August's 10, the two rounds total 41 MarkLogic flaws [20].

What to watch

  • Whether CISA adds any of the 31 flaws to its Known Exploited Vulnerabilities catalog; none was listed on October 13.
  • Any public write-up or proof of concept for the forest-grant escalation, CVE-2026-85947; the report mentions none.
  • Whether Progress documents a workaround or a patched 12.0 release for customers who cannot move to 12.1.0.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence72
Adoption
Not scored
Hype gap−10
Incentives
Not scored
Confidence70
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Progress published all 31 MarkLogic Server flaws on October 12 and scored five of them critical.

    Reported Supported Source: Progress Software disclosure, as reported by The Hacker NewsView cited source
  2. [2]

    Two of the 31 flaws could let an account given only some management privileges take administrator control of the server, the company says.

    Reported Supported Source: Progress Software, as reported by The Hacker NewsView cited source
  3. [3]

    Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0.

    Reported Supported Source: Progress Software, as reported by The Hacker NewsView cited source
  4. [4]

    The MarkLogic 12 line, which Progress calls an innovation release, has no patched 12.0 release; its fix is 12.1.0, which also adds new features. MarkLogic 11.3 is the long-term support line.

    Reported Supported Source: The Hacker NewsView cited source
  5. [5]

    The fixes for the 10 MarkLogic flaws Progress disclosed in August arrived in 11.3.6 and 12.0.3, and both releases are affected by the new flaws, so installing the August fixes is not enough.

    Reported Supported Source: The Hacker NewsView cited source
  6. [6]

    Progress's CVE records and upgrade notes do not say whether any of the 31 flaws has been used in attacks; none was in CISA's Known Exploited Vulnerabilities catalog when The Hacker News checked on October 13.

    Reported Supported Source: The Hacker News, citing Progress CVE records and upgrade notes and the CISA KEV catalogView cited source
  7. [7]

    The CVE records and upgrade notes list no workaround for customers who cannot upgrade yet.

    Reported Supported Source: The Hacker News, citing Progress CVE records and upgrade notesView cited source
  8. [8]

    Progress scored three of the five critical flaws 9.9 out of 10 on the CVSS scale and the other two 9.6. For each one, the attacker must already have a privilege or a way to run code on the server, according to the company's CVE records.

    Reported Supported Source: Progress CVE records, as reported by The Hacker NewsView cited source
  9. [9]

    The fix for CVE-2026-85947 means a "forest-scoped administrative grant" is no longer enough on its own to attach a forest to a database of the account's choosing, the upgrade notes say.

    Reported Supported Source: Progress upgrade notes, as reported by The Hacker NewsView cited source
  10. [10]

    The upgrade notes tell customers to review delegated forest and database privilege assignments before upgrading, and to audit the roles that hold xdmp-eval-in.

    Reported Supported Source: Progress upgrade notes, as reported by The Hacker NewsView cited source
  11. [11]

    Outside researchers reported four of the five critical flaws through Bugcrowd. A researcher using the handle rexnets is credited with CVE-2026-85947, CVE-2026-85948 and CVE-2026-85956, and another using the handle WaltWhitehat with CVE-2026-9191.

    Reported Supported Source: The Hacker NewsView cited source
  12. [12]

    Progress scored 24 of the remaining flaws high and two medium. The highest, CVE-2026-85954, scores 8.6.

    Reported Supported Source: Progress Software, as reported by The Hacker NewsView cited source
  13. [13]

    In deployments that use SAML authentication, an unauthenticated remote attacker could make the server accept an assertion it should reject (CVE-2026-85962).

    Reported Supported Source: Progress CVE records, as reported by The Hacker NewsView cited source
  14. [14]

    OpsDirector, a deprecated feature, could let an unauthenticated remote attacker make requests to internal services or forge trusted requests (CVE-2026-85963).

    Reported Supported Source: Progress CVE records, as reported by The Hacker NewsView cited source
  15. [15]

    The flaws outside the five critical include several that apply only where a named feature or platform is in use, among them the SAML flaw CVE-2026-85962 and the OpsDirector flaw CVE-2026-85963.

    Reported Supported Source: The Hacker NewsView cited source
  16. [16]

    A remote attacker who gets a logged-in Query Console user to open a malicious page could run server-side code with that user's permissions (CVE-2026-85960).

    Reported Supported Source: Progress CVE records, as reported by The Hacker NewsView cited source
  17. [17]

    AWS secret keys and session tokens were written in plaintext when the affected IAM trace path was enabled, the upgrade notes say.

    Reported Supported Source: Progress upgrade notes, as reported by The Hacker NewsView cited source
  18. [18]

    Twenty-six of the 31 flaws are below critical: 24 high and 2 medium, and 5 critical plus 26 gives 31.

    Derived Supported
  19. [19]

    Fixes were available 32 days before Progress published the 31 flaws: September 10 to September 30 is 20 days, plus 12 days to October 12.

    Derived Supported
  20. [20]

    The August round (10 flaws) and the October round (31 flaws) total 41 MarkLogic flaws.

    Derived Supported

Sources

2 independent publishers whose own reporting we read for this story.

  1. dev.to

    1 article · October 13, 2026

    MarkLogic discloses 31 flaws, five rated critical
  2. thehackernews.com

    1 article · October 13, 2026

    Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Topics and entities

Topics

Entities