Earlier this week, Progress issued urgent security updates for its MarkLogic Server after discovering multiple severe vulnerabilities that could let attackers take over administrator accounts, execute code remotely, or access sensitive data. These flaws impact recent releases and pose risks for organizations still running older versions of the database platform. Administrators are being urged to patch immediately.
Which Versions Are Affected and What’s Fixed
The issues target MarkLogic Server versions 12.0 through 12.0.3, and versions 11.0 up to 11.3.6. To resolve them, Progress published fixed builds: version 12.1 addresses the vulnerabilities in the 12.0 line, while version 11.3.7 patches the 11.x branch. Versions 10.x and earlier weren’t fully assessed and won’t see fixes, making an upgrade to at least these supported versions critical.
Flaws That Threaten Security
The most dangerous weakness comes from gaps in privilege handling. Some flaws allow users with limited permissions to perform administrator-level operations. One example, CVE-2026-85947, allows someone with permissions to manage forest-management tasks to create a persistent admin account.
Another issue, CVE-2026-85948, involves an XQuery injection vulnerability in a deprecated Management API path. Even users with just ‘manage-user’ privileges could exploit it to gain long-lasting administrative control. Then there’s CVE-2026-85955, which lets users with query-execution rights invoke privileged evaluation functions, potentially executing server-side code with elevated permissions.
Yet another flaw—CVE-2026-85960—creates a code execution path via predictable CSRF tokens in the Query Console. An attacker could trick an authenticated user into visiting a malicious page and trigger actions using that user’s permissions, bypassing proper checks.
More vulnerabilities concern cloud installations and authentication systems: CVE-2026-85951 allows server-side request forgery (SSRF) in Azure-hosted setups; CVE-2026-85952 carries a similar threat on Linux deployments. A SAML-related defect, CVE-2026-85962, could cause MarkLogic to accept invalid assertions and grant access to unauthenticated attackers. Additional problems include XML external entity issues, path traversal, sensitive data in logs, unsafe TLS hostname validation, and unencrypted transport in certain cluster management and Amazon S3 scenarios. Memory safety flaws round out the tally, risking crashes, data leaks, or corruption.
What Organizations Should Do Now
Progress advises all users to move to version 12.1 (from 12.0–12.0.3) or version 11.3.7 (from 11.0–11.3.6). For those on unsupported versions like 10.x or lower, immediate migration to a supported build is essential. The vendor confirmed that its hosted cloud offering has already been patched.
Beyond upgrades, admins should audit administrator accounts, forest-management permissions, Query Console access, REST and XDBC evaluation paths, authentication logs, and any unusual external connections. Because some vulnerabilities leave almost no trace, normal operation doesn’t guarantee safety. Also, back up your content and security databases before updating—these versions don’t support downgrade, and older client tools like the MarkLogic Content Pump must align with the patched server versions.
This isn’t just another routine patch cycle. The scope of these flaws places special emphasis on exposed management interfaces, privileged users, cloud deployments, and SAML configurations. Prioritizing defenses in those areas could prevent destructive breaches.
Analysis: These vulnerabilities represent a serious wake-up call. As data infrastructure like MarkLogic grows in complexity, privilege escalation and similar flaws have become more common attack vectors. What makes this especially dangerous is how users with minimal rights can exploit them to assume control. For organizations reliant on SAML, cloud setups like Azure, or those with exposed management tools, this serves as a stark reminder: security isn’t just about strong credentials—it’s about limiting permissions, rigorously updating, and staying ahead of stealthy threats. Expect more scrutiny of database platforms going forward, especially from attackers seeking supply chain leverage or silent takeover paths.
