PROGRESS Software has issued a security bulletin in October 2026 noting a total of 31 MarkLogic Server vulnerabilities have been fixed across multiple products and releases. In the published summary, 5 CVEs are highlighted as critical, with three of them scoring 9.9 on CVSSv3 and capable of enabling low-privileged users to achieve elevated code execution or full administrative control.
The fixes are included in MarkLogic Server 12.1.0 and 11.3.7, which are now available, while older supported lines should be upgraded to these fixed releases. The vulnerabilities span several areas, including privilege management in the Progress xdmp:eval-in interface, the Management API, forest operations, and related authentication and data handling paths.
The specific 9.9 CVSS flaws cited are CVE-2026-85955 (xdmp:eval-in), CVE-2026-85948 (Management API), and CVE-2026-85947 (forest operations); a 9.6 severity issue, CVE-2026-85956, concerns backup/restore isolation, and CVE-2026-9191 (9.6) relates to isolated user-supplied code. Progress notes that exploitation in the wild has not been confirmed for these issues to date.
Affected versions include MarkLogic Server 12.0 through 12.0.3 and 11.0 through 11.3.6, with retired 10.x and earlier releases receiving no fixes. Practical responses urged by Progress include upgrading to 12.1 or 11.3.7, migrating retired versions to supported builds, updating mlcp clients, reviewing incompatibility notes due to API changes, and auditing admin accounts for unexpected additions. Progress also states that Cloud Data customers were patched and are no longer vulnerable. The bulletin emphasises that affected instances may show no signs of compromise, underscoring the importance of applying patches promptly.