Progress disclosed 31 vulnerabilities in MarkLogic Server on 12 October 2026. The dangerous ones do not need an outsider with no account. A user who already has a limited management role can turn that role into lasting administrator control.
What happened
CVE-2026-85947 is an authorization flaw in forest-management operations, scored 9.9. A remote user with forest-management rights can create a persistent unauthorized administrator account. That account can remain after the original access is removed, and it may not show up in a routine account review.
Two related critical bugs sit in the same builds. CVE-2026-85948 is XQuery injection in a deprecated Management API path: a manage-user can obtain persistent admin control, also scored 9.9. CVE-2026-85955 lets a user with query access invoke an evaluation function without the extra privilege required, which Progress says can run server-side code with elevated permissions. Fixes are in MarkLogic 11.3.7 and 12.1.0. Progress Data Cloud is already patched. Progress has not reported exploitation or a public proof of concept. August's fixes in 11.3.6 and 12.0.3 do not cover this October set.
Who is affected
- MarkLogic Server 11.x before 11.3.7, including the 11.3 LTS line through 11.3.6
- MarkLogic Server 12.x before 12.1.0, including 12.0 through 12.0.3
- Retired version 10 and earlier, which Progress says were not fully assessed and will not be fixed
What to do now
Upgrade 11.x to 11.3.7 and 12.x to 12.1.0, then review administrator accounts for any that a forest-management or manage-user role should not have created. A hidden admin is a persistence path. Patching alone does not delete an account that was already added. Retire version 10 and older onto a supported fixed release. Progress Data Cloud customers do not need a self-managed upgrade for this bulletin.
Source: CVE-2026-85947 record.
Also on the blog
- GitLab CVE-2026-97229: CVSS 10.0 unauthenticated RCE
- SonicWall CVE-2026-102255 SMA1000 SSRF probed
- Danfoss AK-SM controllers heated French fridges to 50C
- Midnight Mimosa: budget Android phones ship with uninstallable malware
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.