VYPR
Vypr IntelligenceAI-generatedOct 12, 2026· 25 CVEs

Progress MarkLogic Server: 25 Vulnerabilities Including Critical RCE Disclosed Together

Progress MarkLogic Server faces a critical disclosure of 25 vulnerabilities, including RCE and privilege escalation flaws, impacting versions 11.x and 12.x.

Key findings

  • 25 CVEs disclosed simultaneously for Progress MarkLogic Server on Oct 12, 2026.
  • Critical vulnerabilities include remote code execution and privilege escalation flaws.
  • Issues span input sanitization, transport security, authentication, and code execution.
  • Affected versions: MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0.
  • Patched versions: MarkLogic Server 11.3.7 and 12.1.0.

On October 12, 2026, Progress disclosed a significant batch of 25 vulnerabilities affecting Progress MarkLogic Server. These vulnerabilities, disclosed within a single hour, span a range of severities, including three critical flaws, and impact both 11.x and 12.x release lines. The disclosures highlight issues related to input sanitization, transport security, authentication, code execution, and privilege escalation, underscoring the need for prompt patching.

Several vulnerabilities revolve around insecure handling of user-supplied input and data transport. CVE-2026-85976, a medium-severity flaw, stems from insufficient sanitization of input in the Query Console's file-exploration endpoint, potentially leading to HTTP response splitting. High-severity issues include CVE-2026-85975 and CVE-2026-85974, which point to the use of cleartext transport for Amazon S3 connections and certain cluster-management communications, respectively, exposing data and credentials to network attackers. Additionally, CVE-2026-85974 notes inconsistent TLS certificate hostname validation for outbound connections, allowing for man-in-the-middle attacks.

Authentication and authorization weaknesses are also prominent in this batch. CVE-2026-85972 describes a failure to sufficiently verify Kerberos authentication service identity in specific configurations, while CVE-2026-85966 and CVE-2026-85964 highlight issues where authenticated attackers could obtain sensitive information or escalate privileges due to overly permissive access controls or the evaluation of user-controlled values in elevated security contexts. CVE-2026-85963 and CVE-2026-85965 point to vulnerabilities in deprecated OpsDirector functionality and the JavaScript engine integration, respectively, which could lead to unauthorized requests or memory corruption.

Code execution and information disclosure vulnerabilities are also present. CVE-2026-85970 details the default enablement of XML external entity (XXE) processing, allowing crafted XML to trigger server-side requests or disclose local files. CVE-2026-85969 and CVE-2026-85968 describe out-of-bounds write and read vulnerabilities in query-processing functionality, potentially leading to server instability or information disclosure. The critical CVE-2026-9191 and CVE-2026-85955 vulnerabilities allow for unauthorized actions or server-side code execution with elevated permissions due to insufficient isolation of user-supplied code and the invocation of XQuery evaluation functions without proper privileges. CVE-2026-85953, another critical flaw, involves privileged legacy InfoStudio modules that do not sufficiently validate file paths and user-context values, enabling unauthorized file access or execution under unintended identities.

The batch also includes several other high-severity issues. CVE-2026-85964 details a flaw allowing authenticated Query Console users to disclose arbitrary server files via unsafe path values. CVE-2026-85963 and CVE-2026-85965 address weaknesses in deprecated OpsDirector functionality and SAML processing, respectively, potentially allowing unauthenticated attackers to make unauthorized requests or forge trusted requests. CVE-2026-85960 highlights predictable CSRF tokens in the Query Console, enabling attackers to execute server-side code with a victim's permissions. Furthermore, CVE-2026-85959 notes inconsistent recording of successful authentication events in audit logs, hindering detection of unauthorized access. CVE-2026-85956, a critical vulnerability, allows delegated database administrators to perform unauthorized backup or restore operations on forests outside their authorized scope.

Progress has addressed these vulnerabilities in MarkLogic Server 12.1.0 and 11.3.7. Users are strongly advised to update to these patched versions to mitigate the risks associated with this extensive set of disclosures. The wide range of issues, from transport security to remote code execution, emphasizes the critical importance of maintaining up-to-date software and reviewing security configurations for MarkLogic Server deployments.

The vulnerabilities patched include:

All affected versions are prior to MarkLogic Server 12.1.0 and 11.3.7. The patches are available in MarkLogic Server 12.1.0 and 11.3.7.

This extensive disclosure, with 25 CVEs released simultaneously, highlights a critical period for MarkLogic Server administrators. The breadth of vulnerabilities, including critical remote code execution and privilege escalation flaws, necessitates immediate attention. Users should prioritize updating to the patched versions to secure their MarkLogic Server environments against a wide array of potential attacks.

The vulnerabilities disclosed are: CVE-2026-85976, CVE-2026-85975, CVE-2026-85974, CVE-2026-85973, CVE-2026-85972, CVE-2026-85971, CVE-2026-85970, CVE-2026-85969, CVE-2026-85968, CVE-2026-85967, CVE-2026-85966, CVE-2026-85965, CVE-2026-85964, CVE-2026-85963, CVE-2026-85962, CVE-2026-85961, CVE-2026-85960, CVE-2026-85959, CVE-2026-85958, CVE-2026-85957, CVE-2026-9191, CVE-2026-85956, CVE-2026-85955, CVE-2026-85954, CVE-2026-85953.

AI-written article. Grounded in 25 CVE records listed below.