Critical Progress MarkLogic Flaws Let Attackers Remotely Execute Code, Take Over Admin

Key Takeaways

• Progress has issued urgent security updates for MarkLogic Server, addressing multiple critical and high-severity vulnerabilities.
• Affected versions include MarkLogic Server 12.0 through 12.0.3 and 11.0 through 11.3.6.
• These flaws could allow remote code execution, unauthorized administrator account creation, credential theft, and data access.
• Patches are available in MarkLogic Server 12.1 and 11.3.7; cloud customers have already received updates.

Critical Flaws Discovered in Progress MarkLogic Server

Progress has released a series of critical security updates for its MarkLogic Server, addressing a range of vulnerabilities that could enable attackers to achieve remote code execution, establish unauthorized administrative control, steal credentials, and access sensitive data. The extensive security alert, issued on October 12, 2026, highlights significant risks across several MarkLogic Server versions.

The vulnerabilities impact MarkLogic Server versions 12.0 through 12.0.3 and 11.0 through 11.3.6. To mitigate these risks, Progress has made MarkLogic Server 12.1 and 11.3.7 available. Users operating older, unsupported versions, such as MarkLogic 10 and earlier, are strongly advised to migrate to a patched release, as these legacy versions have not undergone full security assessments and will not receive fixes.

Privilege Escalation and Remote Code Execution

Several of the most severe flaws involve improper privilege management, potentially allowing users with limited access to execute actions typically reserved for administrators. One such vulnerability, identified as CVE-2026-85947, pertains to forest-management operations. This flaw could enable a remote user possessing forest-management permissions to establish a persistent, unauthorized administrator account within the system.

Another significant vulnerability, CVE-2026-85948, is an XQuery injection issue found within a deprecated Management API package path. A remote user with manage-user-level permissions could exploit this flaw to gain lasting administrative control. The persistence of these low-level account compromises makes them particularly dangerous, as they can serve as long-term entry points into the database platform.

Further escalating the risk, CVE-2026-85955 could permit a user with query-execution access to invoke an XQuery evaluation function without the necessary elevated privileges. Progress has confirmed that this could lead to server-side code execution with heightened permissions. Similarly, CVE-2026-85960 introduces a code execution path through predictable cross-site request forgery (CSRF) tokens in Query Console. This could allow a malicious webpage to dispatch unauthorized requests when accessed by an authenticated Query Console user, resulting in server-side code execution under that user’s credentials.

These types of vulnerabilities are not isolated incidents for Progress products. Previous reports from HackersRadar have detailed similar issues, including a Progress OpenEdge AdminServer flaw that permitted authenticated users to inject operating system commands via remote administration features, and Progress ShareFile vulnerabilities that could be chained for remote code execution on customer-managed deployments.

Cloud Service Exposure and Authentication Bypass

The recent bulletin also highlights several vulnerabilities that could expose cloud services and authentication mechanisms. CVE-2026-85951, affecting Azure-based installations, could facilitate server-side request forgery (SSRF). An authenticated user could leverage this to request internal cloud services, potentially obtaining sensitive credentials or tokens. A similar risk, CVE-2026-85952, exists for Linux systems.

Progress has also addressed CVE-2026-85962, an improper SAML authentication flaw. In deployments utilizing SAML, an unauthenticated remote attacker could trick MarkLogic into accepting an assertion that should have been rejected, thereby gaining unauthorized access.

Additional issues resolved include XML external entity processing flaws, path traversal vulnerabilities, sensitive data logging, unsafe TLS certificate hostname validation, and cleartext transport for certain cluster-management and Amazon S3 connections. Memory-safety flaws that could lead to process crashes, limited memory disclosure, or data modification were also patched.

Progress strongly recommends upgrading MarkLogic Server 12.0–12.0.3 to version 12.1 and the 11.x branch through 11.3.6 to version 11.3.7. Progress Data Cloud customers have already received these crucial updates.

What You Should Do

• Upgrade Immediately: Install MarkLogic Server 12.1 or 11.3.7 without delay.
• Review Accounts and Permissions: Scrutinize all administrator accounts, forest-management permissions, and Query Console access for any unauthorized changes or excessive privileges.
• Monitor Logs and Connections: Carefully review authentication events, diagnostic logs, and outbound connections for any suspicious activity. Progress warns that affected servers may appear to operate normally, so a lack of obvious indicators does not guarantee a system is uncompromised.
• Backup Databases: Before initiating any upgrade, back up all content and security databases. MarkLogic Server does not support downgrades, meaning an upgrade cannot be easily reversed.
• Update Clients: Upgrade older MarkLogic Content Pump clients to versions compatible with MarkLogic Server 12.1 or 11.3.7.
• Prioritize Exposed Interfaces: Focus on applying updates to deployments with exposed management interfaces, privileged MarkLogic users, cloud-connected environments, and SAML-enabled systems.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.