Full Report
Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0. Affected
Analysis Summary
# Vulnerability: Multiple Critical Flaws in MarkLogic Server
## CVE Details
- **CVE-2026-85947**: 9.9 (Critical) - Privilege Escalation via Forest Management
- **CVE-2026-85948**: 9.9 (Critical) - XQuery Injection in Management API
- **CVE-2026-85955**: 9.9 (Critical) - RCE via `xdmp-eval-in` privilege
- **CVE-2026-85956**: 9.6 (Critical) - Unauthorized Backup/Restore of Security Data
- **CVE-2026-9191**: 9.6 (Critical) - Unauthorized Actions via REST/XDBC paths
- **Total Flaws**: 31 vulnerabilities were disclosed (5 Critical, 24 High, 2 Medium).
## Affected Systems
- **Products**: Progress Software MarkLogic Server
- **Versions**:
- MarkLogic 11.x prior to 11.3.7
- MarkLogic 12.x prior to 12.1.0 (Note: The 12.0.x "Innovation" line has no direct patch; users must move to 12.1.0)
- **Configurations**: Vulnerabilities often require specific privileges (Forest management, Delegated Admin, or `xdmp-eval-in`) or specific features enabled (SAML, OAuth).
## Vulnerability Description
The critical flaws primarily involve privilege escalation and remote code execution (RCE). The most severe issues (CVE-2026-85947 and CVE-2026-85948) allow users with limited management roles to gain full, persistent administrative control over the server. Methods include exploiting XQuery injection in deprecated API paths and abusing "forest-scoped" administrative grants to manipulate security-critical data. Other flaws involve bypassing SAML/OAuth assertion checks and executing server-side code with elevated permissions.
## Exploitation
- **Status**: Not currently exploited in the wild (per CISA KEV as of Oct 13, 2026).
- **Complexity**: Medium (Requires existing privileges/account access).
- **Attack Vector**: Network (Authenticated).
## Impact
- **Confidentiality**: High (Access to all database documents and security data).
- **Integrity**: High (Ability to modify security-critical data and persistent server settings).
- **Availability**: High (Full administrative control allows for complete system shutdown or data deletion).
## Remediation
### Patches
Progress Software released the following versions on September 10, 2026, to address all 31 flaws:
- **MarkLogic 11.3.7** (LTS)
- **MarkLogic 12.1.0** (Innovation Release)
### Workarounds
- No official workarounds have been provided by the vendor. Immediate upgrade is recommended.
## Detection
- **Audit Roles**: Review all accounts assigned the `xdmp-eval-in` privilege.
- **Privilege Review**: Audit delegated forest and database privilege assignments to ensure "forest-scoped" grants are not being abused.
- **Log Monitoring**: Monitor Management API paths and XQuery evaluation logs for unexpected administrative account creation or unauthorized backup/restore activities.
## References
- **Vendor Advisory**: [https://docs.progress.com/bundle/marklogic-server-whats-new-11/page/topics/release-notes.html]
- **CVE Records**: [https://www.cve.org/CVERecord?id=CVE-2026-85947]
- **Source Article**: [https://thehackernews[.]com/2026/10/two-critical-marklogic-flaws-could-give.html]