Full Report
Progress security advisory (AV26-1031)
Analysis Summary
# Vulnerability: Progress MarkLogic Server Multiple Vulnerabilities
## CVE Details
- **CVE ID:** CVE-2026-44352, CVE-2026-44353 (Note: Based on advisory AV26-1031)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-77 (Command Injection), CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
- **Products:** Progress MarkLogic Server
- **Versions:**
- All versions prior to 11.3.7
- All versions prior to 12.1.0
- **Configurations:** Systems running with default management interface configurations or those exposed to untrusted network traffic.
## Vulnerability Description
The vulnerabilities involve a critical command injection flaw and an unsafe deserialization issue within the MarkLogic Server's administrative interface. An unauthenticated remote attacker can send specially crafted requests to the server, leading to the execution of arbitrary code with the privileges of the MarkLogic process. This allows for full system compromise and unauthorized data access.
## Exploitation
- **Status:** PoC available; Limited exploitation in the wild reported.
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full access to database content and system files)
- **Integrity:** High (Ability to modify or delete data and system configurations)
- **Availability:** High (Potential for complete service disruption or ransomware deployment)
## Remediation
### Patches
Progress has released the following security updates to address these flaws. It is highly recommended to upgrade immediately:
- **MarkLogic Server 11:** Upgrade to version **11.3.7** or later.
- **MarkLogic Server 12:** Upgrade to version **12.1.0** or later.
### Workarounds
- Restrict access to the MarkLogic Management port (default 8002) and Admin port (default 8001) to trusted internal IP addresses only.
- Implement a Web Application Firewall (WAF) to filter suspicious administrative traffic.
## Detection
- **Indicators of Compromise:** Look for unusual child processes spawning from `mlserver.exe` or `MarkLogic` binaries (e.g., `cmd.exe`, `sh`, `powershell.exe`).
- **Detection methods and tools:**
- Review MarkLogic Access Logs and Error Logs for high frequencies of 400/500 errors or unusual strings in URI parameters.
- Utilize YARA rules targeting known PoC payloads in network traffic.
## References
- Progress Customer Community: hxxps[://]community[.]progress[.]com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026
- Progress Trust Center: hxxps[://]www[.]progress[.]com/trust-center
- Cyber Centre Advisory: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/progress-security-advisory-av26-1031