MarkLogic discloses 31 flaws, five rated critical

On October 12, 2026, security firm Progress Software disclosed 31 vulnerabilities in its MarkLogic Server database. Of these, five were rated as critical, with three scoring a maximum severity of 9.9 out of 10. Users still running earlier patch versions were particularly exposed. The National Vulnerability Database (NVD) recorded all 31 flaws, labeled by Progress themselves.

The Common Vulnerability Scoring System (CVSS) ranked the flaws on a scale of 0-10 based on severity. The five critical flaws allowed attackers to gain persistent administrator control or execute server-side code with elevated permissions through various exploits. None of the flaws could be exploited by an attacker with no existing account or privileges, as they all required some level of access or the ability to run code on the server.

The flaws originated from delegation features in MarkLogic, where administrators grant limited permissions to other accounts. Some of the critical flaws allowed an account with narrow privileges to escalate to full control. Progress addressed the vulnerabilities in updates to versions 11.3.7 and 12.1.0, released on September 10.

However, users on earlier patch releases, such as 11.3.6 or 12.0.3, remained vulnerable. The Hacker News credited four critical flaws to Bugcrowd researchers. The highest-rated non-critical bug (CVE-2026-85954) also granted elevated privileges. As of October 13, none of the flaws appeared in the US government's catalog of exploited vulnerabilities.