Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
Progress fixed 31 MarkLogic Server flaws, including critical bugs that can give delegated managers persistent admin control.
Progress Software disclosed 31 MarkLogic Server flaws on October 12, five of them critical, with fixes available since September 10 in versions 11.3.7 and 12.1.0. CVE-2026-85947 and CVE-2026-85948, both CVSS 9.9, can let accounts with forest-management or manage-user privileges obtain persistent administrative control, including through XQuery injection. Other critical issues are CVE-2026-85955, CVE-2026-85956, and CVE-2026-9191, all requiring existing privileges or code execution. Progress and CISA records do not report exploitation, and earlier August patches in 11.3.6 and 12.0.3 do not fix the new flaws.
64