Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.
Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.
One, CVE-2026-9192 , was scored 9.8 and allows an unauthenticated remote attacker to bypass password verification on the ODBC App Server, according to its CVE record.
Installing the fixes for the 10 MarkLogic flaws Progress disclosed in August is not enough.
The 12 line, which Progress calls an innovation release, has no patched 12.0 release.
For each one, the attacker must already have a privilege or a way to run code on the server, according to the company's CVE records.
Several of the others apply only where a named feature or platform is in use: The rest include three memory-safety flaws, a cross-site scripting flaw, HTTP response splitting in Query Console, inconsistent TLS hostname checks on some outbound connections, and cleartext cluster-management traffic on 12.x.
The highest, CVE-2026-85954, at 8.6, could allow an attacker to gain more privileges than granted by passing values to certain XQuery functions.
Progress says that could limit a customer's ability to detect and investigate unauthorized access or credential misuse.
Progress's CVE records and its upgrade notes for the two releases do not say whether any of the 31 flaws has been used in attacks.
The fix for CVE-2026-85947 shows which accounts are at issue.
What happened
Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.
One, CVE-2026-9192 , was scored 9.8 and allows an unauthenticated remote attacker to bypass password verification on the ODBC App Server, according to its CVE record.
What changed
Installing the fixes for the 10 MarkLogic flaws Progress disclosed in August is not enough.
The 12 line, which Progress calls an innovation release, has no patched 12.0 release.
Who is affected
For each one, the attacker must already have a privilege or a way to run code on the server, according to the company's CVE records.
Several of the others apply only where a named feature or platform is in use: The rest include three memory-safety flaws, a cross-site scripting flaw, HTTP response splitting in Query Console, inconsistent TLS hostname checks on some outbound connections, and cleartext cluster-management traffic on 12.x.
Why it matters
The highest, CVE-2026-85954, at 8.6, could allow an attacker to gain more privileges than granted by passing values to certain XQuery functions.
Progress says that could limit a customer's ability to detect and investigate unauthorized access or credential misuse.
Technical details
Progress's CVE records and its upgrade notes for the two releases do not say whether any of the 31 flaws has been used in attacks.
The fix for CVE-2026-85947 shows which accounts are at issue.
A researcher using the handle rexnets is credited with CVE-2026-85947, CVE-2026-85948, and CVE-2026-85956, and another using the handle WaltWhitehat is credited with CVE-2026-9191.
Response
Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0 .
Those fixes arrived in 11.3.6 and 12.0.3, and both releases are affected by the new flaws.
What security teams should do
On the fix for CVE-2026-85954, the notes warn: "As a result, you may no longer have privileges that you previously had access to, because that access was incorrect." Some problems remain after the upgrade.
The CVE records and upgrade notes do not say whether upgrading removes an administrator account created through CVE-2026-85947 before the upgrade.
Attribution
The Hacker News: Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.
What to watch next
Watch for updated vendor guidance and fixed-version details.