# Progress MarkLogic Server: 31 Vulnerabilities (CVE-2026-9191, CVE-2026-85947 through CVE-2026-85976) Enabling Privilege Escalation, Code Execution and Authentication Bypass

> Progress disclosed 31 vulnerabilities in MarkLogic Server that could lead to privilege escalation, server-side code execution, SAML authentication bypass, credential exposure and data compromise. Affected versions are 12.0-12.0.3 and 11.0-11.3.6; fixes are in 12.1 and 11.3.7.

- **Published:** 2026-10-13T11:56:43Z
- **Last reviewed:** 2026-10-13T12:28:39.489Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3402
- **ID:** TL-2026-3402
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-9191, CVE-2026-85947, CVE-2026-85948, CVE-2026-85949, CVE-2026-85950, CVE-2026-85951, CVE-2026-85952, CVE-2026-85953, CVE-2026-85954, CVE-2026-85955, CVE-2026-85956, CVE-2026-85957, CVE-2026-85958, CVE-2026-85959, CVE-2026-85960, CVE-2026-85961, CVE-2026-85962, CVE-2026-85963, CVE-2026-85964, CVE-2026-85965, CVE-2026-85966, CVE-2026-85967, CVE-2026-85968, CVE-2026-85969, CVE-2026-85970, CVE-2026-85971, CVE-2026-85972, CVE-2026-85973, CVE-2026-85974, CVE-2026-85975, CVE-2026-85976

## Description

On 2026-10-12 Progress published a MarkLogic Critical Security Alert Bulletin covering 31 CVEs (CVE-2026-9191 and CVE-2026-85947 through CVE-2026-85976). NVD records state that MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. Retired versions (10 and earlier) were not fully assessed and will not receive fixes.

The highest-rated issues per NVD are three CVSS 9.9 flaws (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, all CWE-269). CVE-2026-85947 is an authorization flaw in certain forest-management operations that lets an attacker with forest-management privileges create a persistent, unauthorized administrator account. CVE-2026-85948 is an XQuery injection flaw in a deprecated Management API package path that lets a remote attacker with manage-user-level privileges gain unauthorized administrative access. CVE-2026-85955 lets a remote attacker with query-execution access invoke an XQuery evaluation function without the additional required evaluation privilege, resulting in server-side code execution with elevated permissions. CVE-2026-9191 (CVSS 9.6, CWE-346) concerns insufficient isolation of user-supplied code through REST and XDBC evaluation paths, potentially allowing unauthorized actions or compromise of authenticated sessions. The bulletin also lists further improper-privilege-management issues (CVE-2026-85950, -85953, -85954, -85956) affecting general authorization, file-system access and higher-order XQuery functions.

Authentication and web-layer issues include CVE-2026-85962 (CVSS 7.5, CWE-287/CWE-347), improper authentication in SAML processing that lets unauthenticated attackers submit assertions that should be rejected; CVE-2026-85958 (CVSS 7.5, CWE-287), where the server may accept a token it should reject; CVE-2026-85972 (improper authentication algorithm); and CVE-2026-85960 (CVSS 7.5, CWE-352), predictable CSRF tokens in Query Console that could let a malicious webpage execute server-side code with an authenticated user's permissions.

Other classes: SSRF (CVE-2026-85951 Azure deployments, CVE-2026-85952 Linux installations, and CVE-2026-85963, CVSS 7.5, unauthenticated, in deprecated OpsDirector functionality with a hard-coded cryptographic key, CWE-321/CWE-918), XXE (CVE-2026-85957, -85970), path traversal (CVE-2026-85953, -85964), memory-safety defects (CVE-2026-85965 use-after-free in the JavaScript engine integration, CVSS 8.0, which can cause memory corruption, controlled process failure or server instability; CVE-2026-85968 out-of-bounds read; CVE-2026-85969 out-of-bounds write), sensitive information in logs and insufficient logging (CVE-2026-85949, CVSS 8.1, CWE-532, diagnostic logs recording security-sensitive information under certain configurations; CVE-2026-85961; CVE-2026-85959), information exposure (CVE-2026-85966), incorrect file permission assignment (CVE-2026-85971), cleartext transmission (CVE-2026-85973, -85975), TLS certificate hostname validation (CVE-2026-85974, CVSS 7.4, CWE-297, for certain outbound connections, allowing a network attacker to intercept or alter communications), XSS (CVE-2026-85967) and CRLF/HTTP header injection (CVE-2026-85976).

No in-the-wild exploitation, public PoC, IOCs or attribution have been reported in the sources reviewed. Progress notes that affected instances may operate normally without any prior signs of exploitation. Remediation is to upgrade to 12.1 or 11.3.7, match MarkLogic Content Pump clients to fixed server versions, and review log permissions separately. This is a separate, later bulletin from the August 2026 MarkLogic advisory (Canadian Cyber Centre AV26-781; ten CVEs including CVE-2026-7326, CVE-2026-7329, CVE-2026-8709; fixed in 11.3.6/12.0.3).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1212 Exploitation for Credential Access
- T1552 Unsecured Credentials
- T1557 Adversary-in-the-Middle
- T1040 Network Sniffing
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1189 Drive-by Compromise
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1528 Steal Application Access Token

## Sources

- [Critical Progress MarkLogic Server Vulnerabilities Could Enable Code Execution and Privilege Escalation](https://gbhackers.com/critical-progress-marklogic-server-vulnerabilities/)
- [NVD - CVE-2026-9191](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-9191)
- [NVD - CVE-2026-85947](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85947)
- [NVD - CVE-2026-85948](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85948)
- [NVD - CVE-2026-85949](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85949)
- [NVD - CVE-2026-85955](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85955)
- [NVD - CVE-2026-85958](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85958)
- [NVD - CVE-2026-85960](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85960)
- [NVD - CVE-2026-85962](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85962)
- [NVD - CVE-2026-85963](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85963)
- [NVD - CVE-2026-85965](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85965)
- [NVD - CVE-2026-85974](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85974)
- [Progress MarkLogic Critical Security Alert Bulletin October 2026 (vendor bulletin, cited by NVD; page not retrievable)](https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026)
- [Canadian Centre for Cyber Security - Progress security advisory (AV26-781), earlier MarkLogic bulletin](https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-781)
- [CraftedSignal - August 2026 Progress MarkLogic advisory brief](https://feed.craftedsignal.io/briefs/2026-08-progress-marklogic-advisory/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3402