Progress Software has disclosed 31 vulnerabilities in MarkLogic Server, including two critical flaws that let accounts with limited delegated management privileges create a persistent administrator account and take full control of the server. The flaws, tracked as CVE-2026-85947 and CVE-2026-85948, both carry CVSS scores of 9.9. The first involves forest-management privileges; the second is an XQuery injection flaw in a deprecated Management API path that allows persistent administrative control.
Fixes have been available since September 10 in MarkLogic 11.3.7 and 12.1.0. The 11.3 line is the long-term support release, while 12.1.0 is the innovation release that also adds features. Progress says installing the fixes for the 10 flaws disclosed in August is not enough, because the releases that patched those flaws are affected by the new ones. The company lists no workaround for customers who cannot upgrade yet.
Three other flaws were rated critical, including two at 9.9 and one at 9.6, but they require existing privileges or code execution. Progress's records do not indicate any of the 31 flaws have been exploited, and none appeared in CISA's Known Exploited Vulnerabilities catalog as of October 13. The upgrade notes advise reviewing delegated forest and database privilege assignments and auditing roles that hold xdmp-eval-in before upgrading.