Threat reportVulnerabilityTL-2026-3402
Progress MarkLogic Server: 31 Vulnerabilities (CVE-2026-9191, CVE-2026-85947 through CVE-2026-85976) Enabling Privilege Escalation, Code Execution and Authentication Bypass
Progress MarkLogic Server (TL-2026-3402), also tracked as MarkLogic Critical Security Alert Bulletin October 2026, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-10-13. It has no confirmed attribution, affects Progress Software MarkLogic Server, references 31 CVEs (CVE-2026-9191, CVE-2026-85947, CVE-2026-85948), maps to 15 MITRE ATT&CK techniques (T1005, T1040, T1059), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 9.9/10Critical
- CVEs
- 31Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3402
- Threat ID
- TL-2026-3402
- Also known as
- MarkLogic Critical Security Alert Bulletin October 2026
- Severity
- CRITICAL
- CVSS
- 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
- Updates
- 2026-10-13 · revalidated 1× · latest source
Malware and tooling in Progress MarkLogic Server
Malware and tooling: MarkLogic Content Pump (MLCP)
How Progress MarkLogic Server works
Progress disclosed 31 vulnerabilities in MarkLogic Server that could lead to privilege escalation, server-side code execution, SAML authentication bypass, credential exposure and data compromise. Affected versions are 12.0-12.0.3 and 11.0-11.3.6; fixes are in 12.1 and 11.3.7.
On 2026-10-12 Progress published a MarkLogic Critical Security Alert Bulletin covering 31 CVEs (CVE-2026-9191 and CVE-2026-85947 through CVE-2026-85976). NVD records state that MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. Retired versions (10 and earlier) were not fully assessed and will not receive fixes.
The highest-rated issues per NVD are three CVSS 9.9 flaws (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, all CWE-269). CVE-2026-85947 is an authorization flaw in certain forest-management operations that lets an attacker with forest-management privileges create a persistent, unauthorized administrator account. CVE-2026-85948 is an XQuery injection flaw in a deprecated Management API package path that lets a remote attacker with manage-user-level privileges gain unauthorized administrative access. CVE-2026-85955 lets a remote attacker with query-execution access invoke an XQuery evaluation function without the additional required evaluation privilege, resulting in server-side code execution with elevated permissions. CVE-2026-9191 (CVSS 9.6, CWE-346) concerns insufficient isolation of user-supplied code through REST and XDBC evaluation paths, potentially allowing unauthorized actions or compromise of authenticated sessions. The bulletin also lists further improper-privilege-management issues (CVE-2026-85950, -85953, -85954, -85956) affecting general authorization, file-system access and higher-order XQuery functions.
Authentication and web-layer issues include CVE-2026-85962 (CVSS 7.5, CWE-287/CWE-347), improper authentication in SAML processing that lets unauthenticated attackers submit assertions that should be rejected; CVE-2026-85958 (CVSS 7.5, CWE-287), where the server may accept a token it should reject; CVE-2026-85972 (improper authentication algorithm); and CVE-2026-85960 (CVSS 7.5, CWE-352), predictable CSRF tokens in Query Console that could let a malicious webpage execute server-side code with an authenticated user's permissions.
Other classes: SSRF (CVE-2026-85951 Azure deployments, CVE-2026-85952 Linux installations, and CVE-2026-85963, CVSS 7.5, unauthenticated, in deprecated OpsDirector functionality with a hard-coded cryptographic key, CWE-321/CWE-918), XXE (CVE-2026-85957, -85970), path traversal (CVE-2026-85953, -85964), memory-safety defects (CVE-2026-85965 use-after-free in the JavaScript engine integration, CVSS 8.0, which can cause memory corruption, controlled process failure or server instability; CVE-2026-85968 out-of-bounds read; CVE-2026-85969 out-of-bounds write), sensitive information in logs and insufficient logging (CVE-2026-85949, CVSS 8.1, CWE-532, diagnostic logs recording security-sensitive information under certain configurations; CVE-2026-85961; CVE-2026-85959), information exposure (CVE-2026-85966), incorrect file permission assignment (CVE-2026-85971), cleartext transmission (CVE-2026-85973, -85975), TLS certificate hostname validation (CVE-2026-85974, CVSS 7.4, CWE-297, for certain outbound connections, allowing a network attacker to intercept or alter communications), XSS (CVE-2026-85967) and CRLF/HTTP header injection (CVE-2026-85976).
No in-the-wild exploitation, public PoC, IOCs or attribution have been reported in the sources reviewed. Progress notes that affected instances may operate normally without any prior signs of exploitation. Remediation is to upgrade to 12.1 or 11.3.7, match MarkLogic Content Pump clients to fixed server versions, and review log permissions separately. This is a separate, later bulletin from the August 2026 MarkLogic advisory (Canadian Cyber Centre AV26-781; ten CVEs including CVE-2026-7326, CVE-2026-7329, CVE-2026-8709; fixed in 11.3.6/12.0.3).
MITRE ATT&CK techniques used in TL-2026-3402
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Credential Access
T1040 Network Sniffing; T1212 Exploitation for Credential Access; T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1557 Adversary-in-the-Middle
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Defense Evasion
Persistence
T1098 Account Manipulation; T1136 Create Account
Initial Access
T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application
defense-impairment
Affected products and versions in Progress MarkLogic Server
- Progress Software — MarkLogic Server
Vulnerable versions: 12.0 - 12.0.3; 11.0 - 11.3.6; 10 and earlier (retired, not fully assessed)
Fixed in: 12.1; 11.3.7
Remediation for Progress MarkLogic Server
Patches
- MarkLogic Server 12.1
- MarkLogic Server 11.3.7
- Match MarkLogic Content Pump (MLCP) clients to the fixed server version
Immediate actions
- Upgrade MarkLogic Server to 12.1 or 11.3.7
- Audit MarkLogic administrator accounts and forest-management / manage-user role holders for unauthorized accounts
- Restrict network access to MarkLogic REST, XDBC, Query Console and admin interfaces
- Review diagnostic and audit logs for exposed secrets and rotate any credentials found
Workarounds
- Limit query-execution, forest-management and manage-user privileges to trusted users until patched
- Do not browse untrusted sites from sessions authenticated to Query Console
Longer-term hardening
- Migrate retired MarkLogic versions (10 and earlier) to supported releases
- Review and tighten log file permissions and ensure audit logging is enabled
- Review SAML configuration and assertion validation after upgrade
- Retire deprecated Management API and OpsDirector functionality where not needed
- Enforce TLS for all MarkLogic client and outbound connections
CVEs associated with Progress MarkLogic Server
- CVE-2026-9191
- CVE-2026-85947
- CVE-2026-85948
- CVE-2026-85949
- CVE-2026-85950
- CVE-2026-85951
- CVE-2026-85952
- CVE-2026-85953
- CVE-2026-85954
- CVE-2026-85955
- CVE-2026-85956
- CVE-2026-85957
- CVE-2026-85958
- CVE-2026-85959
- CVE-2026-85960
- CVE-2026-85961
- CVE-2026-85962
- CVE-2026-85963
- CVE-2026-85964
- CVE-2026-85965
- CVE-2026-85966
- CVE-2026-85967
- CVE-2026-85968
- CVE-2026-85969
- CVE-2026-85970
- CVE-2026-85971
- CVE-2026-85972
- CVE-2026-85973
- CVE-2026-85974
- CVE-2026-85975
- CVE-2026-85976
Weaknesses (CWE) in Progress MarkLogic Server
CWE-269, CWE-346, CWE-287, CWE-347, CWE-352, CWE-918, CWE-611, CWE-22, CWE-416, CWE-125
Timeline of Progress MarkLogic Server
- Canadian Cyber Centre publishes AV26-781 on an earlier Progress MarkLogic bulletin (10 CVEs, fixed in 11.3.6 and 12.0.3), distinct from this 31-CVE set.
- Per The Hacker News, MarkLogic Server 11.3.7 and 12.1.0 containing the fixes were released, about 32 days before public disclosure.
- Fixed releases MarkLogic Server 12.1 and 11.3.7 are the remediation targets per the bulletin and NVD records; versions 10 and earlier are retired and will not be fixed.
- NVD scores unauthenticated flaws CVE-2026-85962 (SAML), CVE-2026-85958 (token validation) and CVE-2026-85963 (OpsDirector SSRF) at CVSS 7.5.
- NVD scores CVE-2026-85947 (forest-management admin creation), CVE-2026-85948 (XQuery injection in deprecated Management API) and CVE-2026-85955 (XQuery evaluation without eval privilege) at CVSS 9.9.
- CVE-2026-9191 and CVE-2026-85947 through CVE-2026-85976 are published to NVD, referencing the Progress bulletin.
- Progress publishes the MarkLogic Critical Security Alert Bulletin October 2026 covering 31 vulnerabilities.
- GBHackers reports the vulnerabilities, noting no signs of exploitation may be visible on affected instances and no in-the-wild exploitation is stated.
Update history for TL-2026-3402
- 2026-10-13 — Critical Progress MarkLogic Server Flaws Enable Server-Side Code Execution and Persistent Admin Takeover (CVE-2026-85947, CVE-2026-85948, CVE-2026-85955 and 28 others): What changed No field escalation. The newer report reports exploitability THEORETICAL and status MONITORING, which are not escalations over the existing NONE/PATCHED values, so no field changes were made. New indicators (6) 6 behavioral ind
Sources cited for Progress MarkLogic Server
- Critical Progress MarkLogic Server Vulnerabilities Could Enable Code Execution and Privilege Escalation
- NVD - CVE-2026-9191
- NVD - CVE-2026-85947
- NVD - CVE-2026-85948
- NVD - CVE-2026-85949
- NVD - CVE-2026-85955
- NVD - CVE-2026-85958
- NVD - CVE-2026-85960
- NVD - CVE-2026-85962
- NVD - CVE-2026-85963
- NVD - CVE-2026-85965
- NVD - CVE-2026-85974
- Progress MarkLogic Critical Security Alert Bulletin October 2026 (vendor bulletin, cited by NVD; page not retrievable)
- Canadian Centre for Cyber Security - Progress security advisory (AV26-781), earlier MarkLogic bulletin
- CraftedSignal - August 2026 Progress MarkLogic advisory brief
Detection coverage for TL-2026-3402
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3402 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.