Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Progress Software has disclosed 31 security flaws in MarkLogic Server, including five rated critical, with fixes already shipped in MarkLogic 11.3.7 and 12.1.0 since September 10. Two of the critical bugs stand out: CVE-2026-85947 and CVE-2026-85948, both scored 9.9, which could let a user with only limited delegated management rights (such as forest-management or manage-user privileges) create a persistent administrator account and effectively seize full control of the server. Other high-severity issues (CVE-2026-85955, CVE-2026-85956, CVE-2026-9191) allow elevated code execution or unauthorized cross-database access, while additional flaws affect SAML, OAuth, Kerberos, cloud credential exposure, and logging of sensitive data. Progress has found no evidence of in-the-wild exploitation and none of the CVEs appear in CISA's Known Exploited Vulnerabilities catalog, but customers running 11.x before 11.3.7 or 12.x before 12.1.0 — including those who already applied August's patches — are urged to upgrade promptly, since no workaround exists.