Severity: High | Priority: 2
On October 12, 2026, Progress Software disclosed 31 vulnerabilities in MarkLogic Server, its enterprise NoSQL database. Five are rated critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and 12.1.0. Customers who installed the fixes for the vulnerabilities Progress disclosed in August (11.3.6 or 12.0.3) are still affected and need to upgrade again. No exploitation has been reported, and Progress offers no workaround for customers who can’t upgrade yet.
Three of the vulnerabilities are covered by this update.
- Management API injection (CVE-2026-85948, critical). An account with only limited management privileges can inject XQuery code through a deprecated package-management interface and take persistent administrator control of the server. Progress has removed this interface in the fixed releases.
- Query Console cross-site request forgery (CVE-2026-85960). A remote attacker who gets a logged-in Query Console user to open a malicious web page can run code on the database server with that user’s permissions. The user doesn’t have to do anything beyond opening the page.
- SAML external entity processing (CVE-2026-85957). On MarkLogic 11.x deployments that use SAML sign-on, the server’s SAML parser can process external entities. An attacker can use this to read files from the server or make it send requests to internal systems.
If GajIPS detects exploitation attempts against a MarkLogic server in your network:
- Check the server’s version. If it is older than 11.3.7 or 12.1.0, upgrade immediately.
- Until then, assume the server may be compromised.
- Review administrator and privileged accounts for any that nobody recognises.
- Check recent role and privilege changes.
- Review the audit log. Note that a separate flaw fixed in the same releases meant some successful logins were not recorded, so the log may be incomplete.
- If the Query Console alert fires, find the user whose browser sent the request and the website they were visiting at the time.
