"As a result, you may no longer have privileges that you previously had access to, because that access was incorrect," Progress warns in its upgrade notes — a blunt line that underscores why the vendor has published a second flood of security patches for MarkLogic Server in little more than two months.
Progress's October 12 disclosure: 31 flaws, five critical
On October 12 Progress Software published 31 newly disclosed vulnerabilities for MarkLogic Server and rated five of them critical. Fixes have been available since September 10 in MarkLogic 11.3.7 and MarkLogic 12.1.0. MarkLogic 11.3 is the long-term support (LTS) line; the 12 line is described by Progress as an innovation release and carries no patched 12.0 build — the fix for 12 is 12.1.0, which also introduces new features.
Progress's CVE records and upgrade notes do not state whether any of the 31 flaws have been observed in active attacks. When The Hacker News checked on October 13, none of the CVEs was listed in the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog. The vendor also lists no workaround for customers that cannot upgrade immediately.
CVE-2026-85947 and forest-scoped privileges: how delegated management can persist
Two of the five critical bugs could let an account that was given only partial management privileges take administrator control of the server, Progress says. Three critical flaws scored 9.9 on the CVSS scale and two scored 9.6; for each, an attacker must already possess a privilege or a way to run code on the server, according to the CVE records.
Two of the critical issues involve MarkLogic forests — collections of documents attached to databases. The fix for CVE-2026-85947 specifically changes behavior so that a "forest-scoped administrative grant" is no longer sufficient on its own to attach a forest to a database of the account's choosing. Progress tells customers to review delegated forest and database privilege assignments prior to upgrading and to audit roles that hold xdmp-eval-in.
Outside researchers reported four of the five critical flaws through Bugcrowd. A researcher using the handle rexnets is credited with CVE-2026-85947, CVE-2026-85948, and CVE-2026-85956; WaltWhitehat is credited with CVE-2026-9191.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogConfiguration-dependent vulnerabilities: SAML, OAuth, Kerberos, cloud, and logs
Progress scored 24 of the remaining flaws high and two medium. Many apply only in specific configurations or when particular features are enabled. Examples spelled out in the upgrade notes and CVE records include:
- SAML deployments: an unauthenticated remote attacker could make the server accept an assertion it should reject (CVE-2026-85962); on 11.x the SAML parser could process external DTDs or entities (CVE-2026-85957).
- OAuth: acceptance of tokens the server should not accept, with fixes adding issuer and audience checks for Ping Identity and other OAuth configurations (CVE-2026-85958).
- Password-based Kerberos: in certain configurations an on-network attacker could impersonate the Kerberos authentication service (CVE-2026-85972); the Kerberos fix requires a keytab, and without one the server logs a warning and skips the new check.
- Cloud hosting: an authenticated attacker could access internal cloud services and obtain cloud credentials on Azure (CVE-2026-85951) and on Linux-based cloud deployments (CVE-2026-85952).
- Diagnostic logs and secrets: under some configurations security-sensitive information — including AWS secret keys and session tokens when an affected IAM trace path was enabled — could be written to diagnostic logs in plaintext (CVE-2026-85949 and CVE-2026-85961 on Azure).
- Other issues: Amazon S3 connections could default to cleartext (CVE-2026-85975); Query Console could allow server-side code execution via a malicious page (CVE-2026-85960) or arbitrary file reads by authenticated users (CVE-2026-85964); legacy components like OpsDirector and InfoStudio introduce additional risks (CVE-2026-85963, CVE-2026-85953).
Upgrades, behavioral changes, and compatibility impacts in 11.3.7 and 12.1.0
Progress tells customers to consult the upgrade notes and the known incompatibilities for 11.3.7 and 12.1.0 before applying patches; the 11.3.7 notes list behavior changes tied to 22 of the flaws and the 12.1.0 notes to 21. Notable changes that can break existing code, tools, or automation include:
- MarkLogic Content Pump (mlcp): older mlcp versions fail against the new releases with an XDMP-ISOLATED error; Progress recommends mlcp 11.3.7 or 12.1.0. Older versions can run with -restrict_hosts true, at a potential performance cost.
- Removed features: the /manage/v2/packages API, InfoStudio, and OpsDirector are removed.
- New defaults and permissions: XML external entity processing is off by default; S3 connections default to HTTPS; new and rotated ErrorLog.txt and AuditLog.txt files are created with mode 0640 instead of 0666. Existing log files retain their old permissions until rotated or recreated.
- Privilege changes: xdmp:eval-in() now requires both xdmp-eval-in and xdmp-eval; reading Authorization headers needs a new privilege that no built-in role holds; forest attachment, backup and restore are checked against every forest and database they touch.
- Other platform notes: MarkLogic 11.3.7 does not support Amazon Linux 2; name conflicts during upgrade can occur if the cluster already has certain role, user or privilege names used by a new ticket system.
What this means for technologists, cloud operators, and auditors
- Technologists and security teams: Progress explicitly instructs customers to review delegated forest and database privilege assignments, audit roles holding xdmp-eval-in, and read upgrade notes and incompatibility lists before upgrading.
- Cloud operators and platform teams: teams running MarkLogic on Azure or Linux-based cloud deployments must watch fixes addressing internal cloud-service access and credential exposure; the S3 and diagnostic-log changes alter defaults for cloud integrations.
- Auditors and incident responders: because CVE-2026-85959 could have caused successful logins to go unrecorded in the audit log, Progress warns this may limit a customer's ability to detect and investigate unauthorized access or credential misuse.
This is the second clustered disclosure from Progress in 68 days: on August 5 the vendor published 10 flaws (seven rated critical), and earlier fixes in July preceded the CVE records by weeks. A search of the U.S. National Vulnerability Database on October 13 returned 49 MarkLogic-related CVE records, 41 of them from these two batches. Important questions remain in the published record — for example, Progress's CVE records and upgrade notes do not say whether an administrator account created through CVE-2026-85947 before upgrading will be removed by the upgrade — and customers are left balancing the operational friction of upgraded behavior against the risk these flaws represent.
Original reporting: https://thehackernews.com/2026/10/two-critical-marklogic-flaws-could-give.html
