Progress MarkLogic Server — Critical Authorization and Execution Flaws Enable Privilege Escalation to Administrator (CVE-2026-85947)

Publication date: October 13, 2026
Category: Vulnerability / Web Security

Introduction

Progress Software has published a security bulletin disclosing 31 vulnerabilities discovered in MarkLogic Server, with five rated as critical. Among the most severe findings are authorization and access control flaws that allow attackers with limited management or query-execution privileges to gain persistent administrative control over vulnerable servers. These vulnerabilities were reported via bug bounty platforms and evaluated by the vendor’s engineering teams, prompting emergency patches in versions 11.3.7 and 12.1.0.

What is Progress MarkLogic Server? (General Analysis)

Progress MarkLogic Server is an enterprise-grade multimodal NoSQL database platform designed for the integration and complex management of large volumes of structured and unstructured data (predominantly XML, JSON, and rich text). The server logically organizes data into structures called forests, which attach to specific databases and handle intensive indexing and retrieval operations.

Because MarkLogic is frequently deployed in critical enterprise and government infrastructures to house highly sensitive information, any breach in its access control model introduces a systemic risk. The identified vulnerabilities (such as CVE-2026-85947, CVE-2026-85948, and CVE-2026-85955) undermine established privilege boundaries, allowing identities with delegated roles to execute arbitrary code or manipulate security configurations.

Official CVSS v3.1 vectors and CWE classifications confirmed by the NVD database for the primary critical flaws include:

  • CVE-2026-85947: CVSS 9.9 (CRITICAL) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — CWE-269 (Confirmed data from NVD).
  • CVE-2026-85948: CVSS 9.9 (CRITICAL) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — CWE-269 (Confirmed data from NVD).
  • CVE-2026-85955: CVSS 9.9 (CRITICAL) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — CWE-269 (Confirmed data from NVD).
  • CVE-2026-85956: CVSS 9.6 (CRITICAL) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N — CWE-269 (Confirmed data from NVD).
  • CVE-2026-9191: CVSS 9.6 (CRITICAL) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H — CWE-346 (Confirmed data from NVD).

How Does It Work? (Technical Analysis)

An analysis of the 31 vulnerabilities reveals multiple attack surfaces ranging from logical errors in forest management to flaws in federation protocols (SAML/OAuth) and legacy components.

  • Privilege Escalation via Forest Management (CVE-2026-85947): An attacker possessing credentials with limited forest-management privileges can exploit deficient authorization checks to attach forests to databases outside their authorized scope, successfully creating unauthorized persistent administrator accounts.
  • XQuery Injection in Management Paths (CVE-2026-85948): Through a deprecated management API path, a user with manage-user-level permissions can inject malicious XQuery code, bypassing role restrictions and establishing permanent administrative control.
  • Unchecked Function Evaluation (CVE-2026-85955 & CVE-2026-85954): The engine permits higher-order XQuery evaluation functions (such as xdmp-eval-in) to be invoked within an elevated security context without strictly verifying the caller’s supplementary permissions, resulting in code execution under elevated privileges.
  • Integration and Configuration Flaws (SAML, OAuth, Kerberos, Cloud): Additional vulnerabilities like CVE-2026-85962 and CVE-2026-85957 allow SAML assertion manipulation or insecure external DTD processing in 11.x releases. Furthermore, secret disclosures were uncovered in AWS IAM traces (CVE-2026-85949) and default cleartext connections to Amazon S3 (CVE-2026-85975).

Affected Systems / Environments

The vulnerabilities impact the primary development branches of the database server:

  • Progress MarkLogic Server 11.x releases prior to 11.3.7 (Long-Term Support branch).
  • Progress MarkLogic Server 12.x releases prior to 12.1.0 (Innovation branch).
CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2026-85947 CWE-269 Persistent admin account creation 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-85948 CWE-269 Admin control via XQuery injection 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-85955 CWE-269 Code execution with elevated permissions 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-85956 CWE-269 Unauthorized forest backup/restore 9.6 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVE-2026-9191 CWE-346 Isolation bypass in REST/XDBC paths 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Mitigation and Detection

Remediation

System administrators must immediately apply the patches provided by the vendor:

  • Upgrade 11.x installations to MarkLogic 11.3.7 or later.
  • Upgrade 12.x installations to MarkLogic 12.1.0 or later.
  • Operational Reviews: It is imperative to review and audit delegated forest and database privilege assignments, examine roles holding xdmp-eval-in, and verify connectivity settings with AWS S3 and external identity providers. Note that legacy client tools such as MarkLogic Content Pump (mlcp) may require upgrading to version 11.3.7 or 12.1.0 to remain compatible with new isolation restrictions.

Detection

Defensive security teams should thoroughly monitor audit logs for anomalies regarding unexpected administrative account creation and query executions within unusual security contexts.

“The presence of administrative accounts created outside authorized maintenance windows or anomalous use of evaluation functions in deprecated management paths serves as a critical indicator of compromise against this MarkLogic flaw campaign.”

  • Log Monitoring: Actively inspect ErrorLog.txt and AuditLog.txt files (whose default permissions have been hardened to 0640) to detect SAML authentication bypass attempts, OAuth token validation failures, or debug logs that may have exposed AWS IAM secret keys.

Wrapping Up

The disclosure of 31 vulnerabilities in MarkLogic Server highlights the inherent complexity of enterprise data platforms and the necessity of maintaining rigorous access control policies based on the principle of least privilege (PoLP). With multiple critical flaws allowing delegated users to escalate to full server control, applying patches for versions 11.3.7 and 12.1.0 alongside deep role and evaluation function audits is an essential mandate for enterprise infrastructure protection.

References