Critical MarkLogic flaws could let delegated managers seize admin control

Progress has disclosed 31 security flaws in MarkLogic Server, including two critical issues that could allow accounts with limited administrative privileges to gain control over parts of a deployment. The fixes are available, so affected operators should treat upgrading as urgent. ¹²

What the critical flaws allow

The most serious issues involve forest-scoped administrative grants. Progress says one fix stops an account with that grant from attaching a forest to a database of its choice, while customers are also told to review delegated forest and database privileges and audit roles holding `xdmp-eval-in`. ²

Five of the 31 flaws were rated critical. Progress scored three at 9.9 and two at 9.6 on the CVSS scale, although the highest-severity issues require an attacker to already have a privilege or a way to run code on the server, according to the company's records. ¹

The wider batch also covers SAML, OAuth, Kerberos, cloud-hosting, diagnostic-log, Query Console and Amazon S3 configurations. Some flaws only apply when those features or deployments are in use. ¹²

Which versions are fixed

Progress lists MarkLogic 11.3.7 and 12.1.0 as the relevant fixed releases. MarkLogic 11.3.7 is the long-term-support line, while the MarkLogic 12 fix is in 12.1.0 rather than 12.0. ¹²

The upgrade notes warn of compatibility changes, including the removal of the `/manage/v2/packages` API, InfoStudio and OpsDirector, altered privilege checks, and new defaults for XML external entities, S3 connections and log-file permissions. Administrators should read the version-specific incompatibility notes before upgrading. ²

No exploitation is confirmed

The source reporting and Progress records do not say that these flaws have been used in attacks. None was listed in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue when checked on 13 October 2026. That does not reduce the need to patch: the issues affect an enterprise database platform and several require only existing access or a vulnerable configuration. ¹

Our opinion

The important detail is not the dramatic CVSS numbers; it is the privilege boundary. Several of the most serious problems assume an attacker already has some foothold, which makes delegated roles, exposed management interfaces and stale installations the practical pressure points. MarkLogic operators should inventory those permissions before upgrading, then test the fixed release against their own tooling rather than treating the patch as a drop-in change.