PROGRESS Software’s MarkLogic Server has 31 newly disclosed vulnerabilities, with five rated critical. The flaws could let an account that already has only management privileges escalate to full administrative control of the server, including creating persistent admin accounts or running code with elevated rights. CVSS scores for the critical flaws are reported as 9.9 for three of them and 9.6 for the other two.
The affected CVEs include CVE-2026-85947, CVE-2026-85948, CVE-2026-85955, CVE-2026-85956 and CVE-2026-85959. In practice, exploitation requires prior privileges or a way to execute code on the server, and the flaws involve forest management, delegated privileges, and server-side code execution via certain paths.
Progress notes that a forest-scoped administrative grant on its own is no longer sufficient to attach a forest to a chosen database after the fix, and customers should audit delegated forest and database privileges and the xdmp-eval-in role before upgrading.
Progress has published fixes for MarkLogic 11.x (11.3.7) and 12.x (12.1.0); users on 11.x before 11.3.7 or 12.x before 12.1.0 are advised to upgrade. Note that fixes also apply to earlier August‑disclosed flaws; upgrading 11.3.7 or 12.1.0 does not remedy issues present in 11.3.6 or 12.0.3. The record shows no confirmed exploitation in the U.S. CISA Known Exploited Vulnerabilities catalog as of 13 October, and no workarounds are provided for those who cannot immediately upgrade.
Additional CVEs in the broader batch include issues affecting SAML, OAuth, Kerberos, cloud hosting, diagnostic logs, and legacy components, among others. Some problems may persist after upgrading, such as log file permissions and certain authentication checks, requiring attention to upgrade notes and configuration.