Progress has disclosed 31 vulnerabilities in MarkLogic Server, five of them critical, including two CVSS 9.9 flaws that let an account holding only delegated management rights create a persistent administrator. If you run MarkLogic 11.x below 11.3.7 or 12.x below 12.1.0, your delegated-admin model is not containing anyone.
What happened
The Hacker News reported on October 13, 2026 that Progress disclosed the 31 CVEs on October 12. The fixes themselves shipped earlier: MarkLogic 11.3.7 and 12.1.0 were released on September 10, 2026. The previous releases, 11.3.6 (July 1, 2026) and 12.0.3 (July 6, 2026), fixed the 10 flaws Progress disclosed in August but are affected by this batch. According to the report, Progress lists no workaround for customers who cannot upgrade.
The five critical issues, as described by The Hacker News and the Progress upgrade notes:
- CVE-2026-85947 (CVSS 9.9): an account with forest-management privileges can create a persistent administrator account. Progress's 11.3.7 notes say attaching a forest now requires authorization for both the forest and the target database; a forest-scoped grant alone is no longer enough.
- CVE-2026-85948 (CVSS 9.9): an account with manage-user-level privileges can reach persistent admin through an XQuery injection in a deprecated Management API path. Progress removed
/manage/v2/packagesand points users to/manage/v3. - CVE-2026-85955 (CVSS 9.9): an account that can run queries and holds the
xdmp-eval-inprivilege can execute server code with elevated permissions.xdmp:eval-in()now requires bothxdmp-eval-inandxdmp-eval. - CVE-2026-85956 (CVSS 9.6): delegated database-admin privileges allowed backup and restore of forests outside the authorized database.
- CVE-2026-9191 (CVSS 9.6): code run through REST and XDBC evaluation paths could compromise an authenticated session. That code now runs isolated from HTTP request, response and session state.
Other fixes cover SAML assertion validation, OAuth token issuer and audience checks, Kerberos, Azure and Linux cloud credential exposure, and Query Console. The Hacker News also reported that CVE-2026-85959 meant successful logins were not always recorded in the audit log. As of October 13, none of the CVEs were in CISA's KEV catalog and no exploitation had been reported.
Why it matters
Delegated administration exists to cap the blast radius of a compromised or careless operator. Someone who manages forests or users should not be able to make themselves a full admin. These bugs remove that boundary: every critical flaw requires some prior privilege or code execution, but the privileges involved are exactly the ones teams hand out to keep people away from the admin role.
Until the upgrade lands, anyone holding forest-management, manage-user, delegated database-admin or xdmp-eval-in rights should be treated as a potential administrator. The audit logging gap matters too: if successful logins were not always captured, a clean audit log is weaker evidence than usual that those accounts were not misused.
What to check in your environment
- Inventory MarkLogic versions. Anything on 11.x before 11.3.7 or 12.x before 12.1.0 needs the upgrade. Do not stop at 11.3.6 or 12.0.3.
- List who holds the escalation-relevant rights: forest-management grants, manage-user privileges, delegated database-admin roles, and roles carrying
xdmp-eval-in. Remove any that are not needed and treat the rest as privileged until patched. - Look for unexpected administrator accounts or role changes on affected clusters, keeping in mind that successful logins may be missing from audit logs.
- Clear upgrade blockers first. Progress says the upgrade can fail if a role, user or privilege already exists named
manage-ticket-internal,manage-ticket-admin-internal,manage-ticket-task-runner,manage-ticket-admin-userormanage-ticket-operations. AWS deployments still on Amazon Linux 2 must move to a supported OS before upgrading. - Upgrade mlcp alongside the server. Older mlcp versions fail against the new releases with
XDMP-ISOLATEDerrors. The Hacker News notes older versions can run with-restrict_hostsset to true, at a performance cost. - Find integrations on removed or stricter paths before upgrading: callers of
/manage/v2/packages, eval code that reads request headers or session state, and SAML or OAuth sign-in, which will now reject mismatched issuer or audience.