Progress Software published its October Critical Security Alert Bulletin for MarkLogic Server, fixing 31 vulnerabilities. Three are rated CVSS 9.9. Fixes ship in MarkLogic 12.1 and 11.3.7, and Progress reports no exploitation and no public proof-of-concept code.
Three CVSS 9.9 Flaws in MarkLogic Server
The most serious flaws let a user with limited rights gain far more control over the database server. All three carry the same 9.9 score.
CVE-2026-85955 Elevates Code Execution for Users With Query Access
CVE-2026-85955 allows a user who has query access to run code with elevated permissions. A role intended only to read data can therefore become a path to executing commands with higher privileges on the server.
CVE-2026-85947 Lets Forest-Management Users Create a Hidden Admin Account
CVE-2026-85947 affects users with forest-management rights, who can create a hidden administrator account. A concealed admin account is a persistence mechanism, since it can remain after the original access is closed and is not visible to routine account review.
CVE-2026-85948 Injection Flaw in a Deprecated Management API
CVE-2026-85948 is an injection flaw in a deprecated management API. The score matches the other two critical bugs. Injection flaws let attacker-controlled input be interpreted as part of a command or query, and the fact that this one sits in a deprecated API shows that features slated for removal can still carry serious risk while they remain in a shipped product.
The three critical bugs each depend on some level of existing access: query access, forest-management rights, or access to the management API. Even so, a 9.9 score reflects how much an attacker gains once that foothold exists, from elevated code execution to a concealed administrator account.
Additional Fixes Cover Cleartext Traffic, TLS Checks and Login Logging
The bulletin also fixes weaker security behaviors that do not carry the same scores. Some connections used cleartext transport, with Amazon S3 connections named as the default case. Some outbound links lacked TLS hostname checks. Successful logins were also not always logged, which reduces the audit trail available to investigators.
The cleartext and TLS findings affect data in transit. Connections that default to cleartext transport, such as those to Amazon S3, can expose data and credentials to anyone positioned on the network path. Outbound links without TLS hostname checks cannot reliably confirm they are talking to the intended server. Neither issue is scored as critical in the report, but both weaken the protection around data the database handles.
Together with the three critical flaws, the potential impact includes admin takeover, data access or modification, credential exposure, code execution and reduced auditability.
Progress Warns That Compromised Instances Give No Advance Warning
Progress cautions that affected instances “exhibit no advance warning and continue to operate normally.” The company adds that the absence of indicators does not prove a system has not been exploited. For administrators, that means a clean-looking server offers little reassurance, particularly given that logging of successful logins had gaps.
No exploitation or public proof-of-concept has been reported. Progress Data Cloud customers have already been patched, so the remaining work falls on organizations that run MarkLogic Server themselves.
Upgrade Path to MarkLogic 12.1 or 11.3.7
The remedy is to upgrade to MarkLogic 12.1 or 11.3.7. The bulletin was published on October 12. All details in this report come from one report on the bulletin, so teams should confirm the specifics against Progress’s own advisory before scheduling the upgrade.
The combination of a hidden-account flaw and logging gaps raises a practical point for self-hosted customers. After upgrading, a review of existing administrator accounts for unexpected entries is a sensible check, since the bulletin itself says normal operation is not evidence of safety.
