Critical Progress MarkLogic Flaws Enable Remote Code Execution and Admin Takeover

Progress released urgent security updates for MarkLogic Server to fix a broad set of critical and high-severity flaws that could let attackers gain elevated access, create unauthorized administrator accounts, execute code on servers, steal credentials, and access protected data.

The security alert, published on October 12, 2026, affects MarkLogic Server 12.0 through 12.0.3 and MarkLogic Server 11.0 through 11.3.6.

Progress has released MarkLogic Server 12.1 and 11.3.7 to address the issues. Organizations running retired MarkLogic versions, including version 10 and earlier, should move to a supported fixed release because those versions were not fully assessed and will not receive fixes.

The most serious MarkLogic flaws involve improper privilege management, where a user with limited access may be able to perform actions reserved for an administrator.

CVE-2026-85947 affects forest-management operations and could let a remote user with forest-management permissions create a persistent, unauthorized administrator account.

Progress MarkLogic Flaws

Another issue, CVE-2026-85948, is an XQuery injection flaw in a deprecated Management API package path. A remote user with manage-user-level permissions could use the flaw to gain persistent administrative control. These weaknesses matter because a low-level account can become a long-term entry point into the database platform.

CVE-2026-85955 may allow a user with query-execution access to invoke an XQuery evaluation function without the required extra privilege. Progress said this could result in server-side code execution with elevated permissions.

CVE-2026-85960 also creates a code execution path through predictable cross-site request forgery tokens in Query Console. A malicious webpage could send unauthorized requests when opened by an authenticated Query Console user, causing server-side code to run with that user’s permissions.

This pattern resembles other recent Progress product security issues, including the Progress OpenEdge AdminServer flaw that allowed authenticated users to inject operating-system commands through remote administration features.

Cyber Security News has also reported on Progress ShareFile vulnerabilities that could be chained to obtain remote code execution on affected customer-managed deployments.

Several vulnerabilities could expose cloud services and authentication material. CVE-2026-85951 affects Azure-based installations and could enable server-side request forgery, or SSRF, allowing an authenticated user to request internal cloud services and potentially obtain credentials or tokens. CVE-2026-85952 presents a similar risk on Linux systems.

Progress also fixed CVE-2026-85962, an improper SAML authentication issue. In deployments that use SAML, an unauthenticated remote attacker could cause MarkLogic to accept an assertion that should have been rejected, opening a path to unauthorized access.

Other notable issues include XML external entity processing flaws, path traversal weaknesses, sensitive data written to logs, unsafe TLS certificate hostname validation, and cleartext transport for certain cluster-management and Amazon S3 connections.

The bulletin also lists memory-safety flaws that could cause process crashes, limited memory disclosure, or data modification. Progress strongly recommends upgrading MarkLogic Server 12.0–12.0.3 to version 12.1 and upgrading the 11.x branch through 11.3.6 to version 11.3.7. The vendor says Progress Data Cloud customers have already been patched.

Administrators should review administrator accounts, forest-management permissions, Query Console access, REST and XDBC evaluation paths, authentication events, diagnostic logs, and unexpected outbound connections.

The company warned that affected servers may operate normally and that missing indicators do not prove a system has not been compromised.

Before upgrading, teams should back up content and security databases. Progress notes that MarkLogic Server does not support downgrades, so an upgrade cannot simply be reversed after installation. Older MarkLogic Content Pump clients should also be upgraded to versions that match MarkLogic Server 12.1 or 11.3.7.

The large number of fixed flaws makes this more than a routine patch cycle. Organizations should prioritize exposed management interfaces, privileged MarkLogic users, cloud-connected deployments, and SAML-enabled environments when applying the vendor’s updates.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Critical Progress MarkLogic Flaws Enable Remote Code Execution and Admin Takeover appeared first on Cyber Security News.