{
  "id": 14260151,
  "title": "MarkLogic discloses 31 flaws, five rated critical",
  "url": "https://urgent.news/2026/10/13/marklogic-discloses-31-flaws-five-rated-critical",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-13T18:12:18.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/techaiwire/marklogic-discloses-31-flaws-five-rated-critical-4omg"
  },
  "original_language": "en",
  "account": "On October 12, 2026, security firm Progress Software disclosed 31 vulnerabilities in its MarkLogic Server database. Of these, five were rated as critical, with three scoring a maximum severity of 9.9 out of 10. Users still running earlier patch versions were particularly exposed. The National Vulnerability Database (NVD) recorded all 31 flaws, labeled by Progress themselves. The Common Vulnerability Scoring System (CVSS) ranked the flaws on a scale of 0-10 based on severity. The five critical flaws allowed attackers to gain persistent administrator control or execute server-side code with elevated permissions through various exploits. None of the flaws could be exploited by an attacker with no existing account or privileges, as they all required some level of access or the ability to run code on the server. The flaws originated from delegation features in MarkLogic, where administrators grant limited permissions to other accounts. Some of the critical flaws allowed an account with narrow privileges to escalate to full control. Progress addressed the vulnerabilities in updates to versions 11.3.7 and 12.1.0, released on September 10. However, users on earlier patch releases, such as 11.3.6 or 12.0.3, remained vulnerable. The Hacker News credited four critical flaws to Bugcrowd researchers. The highest-rated non-critical bug (CVE-2026-85954) also granted elevated privileges. As of October 13, none of the flaws appeared in the US government's catalog of exploited vulnerabilities.",
  "summary": "Progress Software published 31 security flaws in its MarkLogic Server database on October 12, 2026. Five are rated critical, and three of those score 9.9 out of 10. The fixes already exist: they shipped in MarkLogic 11.3.7 and 12.1.0 on September 10. Anyone still on the August patch releases, 11.3.6 or 12.0.3, is exposed. The 31 flaws at a glance The National Vulnerability Database lists all 31…",
  "key_points": [
    "MarkLogic disclosed 31 vulnerabilities in its MarkLogic Server database on October 12, 2026",
    "Five vulnerabilities rated critical, three with maximum severity of 9.9/10",
    "Users on earlier patch versions (11.3.6, 12.0.3) remain vulnerable"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}