Installing MarkLogic's August fixes leaves 31 newer flaws open
Progress Software published 31 MarkLogic Server flaws on October 12, five of them critical. The 11.3.6 and 12.0.3 releases that fixed August's 10 flaws are affected. Fixes are in 11.3.7 and 12.1.0.
The Watch · Security desk
Progress scored five of the 31 flaws critical. Three of those critical flaws score 9.9 out of 10 on the CVSS scale. Progress scored 24 of the remaining flaws high.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Flaws Progress scored critical, of 31 | 5 flaws | 1 | |
| Three critical flaws' CVSS | 9.9 out of 10 | 8 | |
| Other flaws scored high | 24 flaws | 12 |
What happened
- Two of the 31 flaws could let an account holding only some management privileges take administrator control of the server, Progress says.
- Fixes have been available since September 10, 32 days before Progress published the 31 flaws on October 12.
- Progress's records do not say whether any flaw has been used in attacks, and none was in CISA's Known Exploited Vulnerabilities catalog on October 13.
Why it matters
- exposure Accounts holding a forest-scoped administrative grant are the ones at issue. Before the fix, that grant alone was enough to attach a forest to a database of the account's choosing.
- cost Customers on 12.0.3 have no patched 12.0 release to move to. Their fix is 12.1.0, which also adds new features, so the security upgrade comes with a feature release to test.
- constraint Neither the CVE records nor the upgrade notes include a workaround for servers that cannot upgrade yet.
- decision The notes ask for a review of delegated forest and database privilege assignments, and an audit of roles holding xdmp-eval-in, before upgrading.
The critical scores sit on flaws that need a foothold. Progress's CVE records show that each of the five requires an attacker who already holds a privilege or can already execute code on the server [8]. Two others are reachable without authentication, and neither is among the critical five [15]. CVE-2026-85962 lets an unauthenticated remote attacker make the server accept a SAML assertion it should reject, but only in deployments that use SAML authentication [13]. CVE-2026-85963 lets an unauthenticated remote attacker make requests to internal services or forge trusted requests through OpsDirector, a deprecated feature [14]. A server without SAML authentication is outside the first [13].
Of the 26 flaws below critical, 24 are high and two are medium, led by CVE-2026-85954 at 8.6 [18][12]. Others depend on a user action or a setting. CVE-2026-85960 requires a logged-in Query Console user to open a malicious page, after which the attacker can run server-side code with that user's permissions [16]. Turning on the affected IAM trace path left AWS secret keys and session tokens in plaintext, according to the upgrade notes [17].
Four of the five critical flaws were reported by outside researchers via Bugcrowd. Credit for CVE-2026-85947, CVE-2026-85948 and CVE-2026-85956 goes to a researcher known as rexnets, and for CVE-2026-9191 to one known as WaltWhitehat [11]. The report did not identify the two CVEs that carry the delegated-manager escalation. Together with August's 10, the two rounds total 41 MarkLogic flaws [20].
What to watch
- Whether CISA adds any of the 31 flaws to its Known Exploited Vulnerabilities catalog; none was listed on October 13.
- Any public write-up or proof of concept for the forest-grant escalation, CVE-2026-85947; the report mentions none.
- Whether Progress documents a workaround or a patched 12.0 release for customers who cannot move to 12.1.0.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Progress published all 31 MarkLogic Server flaws on October 12 and scored five of them critical.
- [2]
Two of the 31 flaws could let an account given only some management privileges take administrator control of the server, the company says.
- [3]
Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0.
- [4]
The MarkLogic 12 line, which Progress calls an innovation release, has no patched 12.0 release; its fix is 12.1.0, which also adds new features. MarkLogic 11.3 is the long-term support line.
- [5]
The fixes for the 10 MarkLogic flaws Progress disclosed in August arrived in 11.3.6 and 12.0.3, and both releases are affected by the new flaws, so installing the August fixes is not enough.
- [6]
Progress's CVE records and upgrade notes do not say whether any of the 31 flaws has been used in attacks; none was in CISA's Known Exploited Vulnerabilities catalog when The Hacker News checked on October 13.
- [7]
The CVE records and upgrade notes list no workaround for customers who cannot upgrade yet.
- [8]
Progress scored three of the five critical flaws 9.9 out of 10 on the CVSS scale and the other two 9.6. For each one, the attacker must already have a privilege or a way to run code on the server, according to the company's CVE records.
- [9]
The fix for CVE-2026-85947 means a "forest-scoped administrative grant" is no longer enough on its own to attach a forest to a database of the account's choosing, the upgrade notes say.
- [10]
The upgrade notes tell customers to review delegated forest and database privilege assignments before upgrading, and to audit the roles that hold xdmp-eval-in.
- [11]
Outside researchers reported four of the five critical flaws through Bugcrowd. A researcher using the handle rexnets is credited with CVE-2026-85947, CVE-2026-85948 and CVE-2026-85956, and another using the handle WaltWhitehat with CVE-2026-9191.
- [12]
Progress scored 24 of the remaining flaws high and two medium. The highest, CVE-2026-85954, scores 8.6.
- [13]
In deployments that use SAML authentication, an unauthenticated remote attacker could make the server accept an assertion it should reject (CVE-2026-85962).
- [14]
OpsDirector, a deprecated feature, could let an unauthenticated remote attacker make requests to internal services or forge trusted requests (CVE-2026-85963).
- [15]
The flaws outside the five critical include several that apply only where a named feature or platform is in use, among them the SAML flaw CVE-2026-85962 and the OpsDirector flaw CVE-2026-85963.
- [16]
A remote attacker who gets a logged-in Query Console user to open a malicious page could run server-side code with that user's permissions (CVE-2026-85960).
- [17]
AWS secret keys and session tokens were written in plaintext when the affected IAM trace path was enabled, the upgrade notes say.
- [18]
Twenty-six of the 31 flaws are below critical: 24 high and 2 medium, and 5 critical plus 26 gives 31.
- [19]
Fixes were available 32 days before Progress published the 31 flaws: September 10 to September 30 is 20 days, plus 12 days to October 12.
- [20]
The August round (10 flaws) and the October round (31 flaws) total 41 MarkLogic flaws.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toMarkLogic discloses 31 flaws, five rated critical
1 article · October 13, 2026
- thehackernews.comTwo Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Entities
- Progress SoftwareFollow
- BugcrowdFollow
- CISA Known Exploited Vulnerabilities CatalogFollow
- MarkLogic ServerFollow
- The Hacker NewsFollow