MarkLogic Server (Product): news timeline & CVEs

Progress security advisory (AV26-1031)

Canada's Cyber Centre warns Progress MarkLogic before 11.3.7 and 12.1.0 needs security updates.

The Canadian Centre for Cyber Security published advisory AV26-1031 on October 13, 2026. As of October 12, 2026, Progress MarkLogic Server versions prior to 11.3.7 and prior to 12.1.0 are affected by vulnerabilities. Administrators are directed to Progress Customer Community and Trust Center notices and told to apply available updates. The bulletin does not list CVE identifiers or say the flaws are being exploited.

Canadian Centre for Cyber Securityupdated Oct 16, 17:50 UTC · 12h agofirst Oct 13, 13:36 UTC · 3d agoAdvisory 2 sources1· 1 read

Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Progress fixed 31 MarkLogic Server flaws, including critical bugs that can give delegated managers persistent admin control.

Progress Software disclosed 31 MarkLogic Server flaws on October 12, five of them critical, with fixes available since September 10 in versions 11.3.7 and 12.1.0. CVE-2026-85947 and CVE-2026-85948, both CVSS 9.9, can let accounts with forest-management or manage-user privileges obtain persistent administrative control, including through XQuery injection. Other critical issues are CVE-2026-85955, CVE-2026-85956, and CVE-2026-9191, all requiring existing privileges or code execution. Progress and CISA records do not report exploitation, and earlier August patches in 11.3.6 and 12.0.3 do not fix the new flaws.

The Hacker NewsOct 13, 08:44 UTC · 3d agoVulnerability CVE-2026-85947 CVE-2026-85948 CVE-2026-85955+16 CVEs1

MarkLogic Server

Timeline2 articles

Related CVEsby mentions

Appears with

Progress security advisory (AV26-1031)

Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control