CriticalMalwareCVE-2026-85947
Critical Progress MarkLogic Flaws Enable Remote Code Execution and Admin Takeover
Cyber Security News·Source published ·1 min read
What happened?
Progress released urgent security updates for MarkLogic Server to fix a broad set of critical and high-severity flaws that could let attackers gain elevated access, create unauthorized administrator accounts, execute code on servers, steal credentials, and access protected data. The security alert, published on October 12, 2026, affects MarkLogic Server 12.0 through 12.0.3 and MarkLogic Server 11.0 through 11.3.6. Progress has released MarkLogic Server 12.1 and 11.3.7 to address the issues.
Key details
- MarkLogic Server 12.0-12.0.3 and 11.0-11.3.6 affected by multiple critical flaws enabling remote code execution and admin takeover.
- CVE-2026-85947 allows unauthorized admin account creation via forest-management operations.
- CVE-2026-85948 is an XQuery injection flaw in deprecated Management API enabling persistent admin control.
- CVE-2026-85955 permits server-side code execution with elevated permissions via query-execution access.
- CVE-2026-85960 enables code execution through predictable CSRF tokens in Query Console.
- CVE-2026-85951 affects Azure installations enabling SSRF to obtain cloud credentials.
- CVE-2026-85952 presents similar SSRF risk on Linux systems.
Affected
- MarkLogic Server 12.0 through 12.0.3 and 11.0 through 11.3.6.
- Versions 10 and earlier are retired and not fully assessed for fixes.
Fixes and mitigations
- Upgrade Older MarkLogic Content Pump clients to versions matching 12.1 or 11.3.7.
What to look for
- Review administrator accounts and forest-management permissions for unauthorized changes.
- Monitor for unexpected outbound connections and authentication events.
- Check diagnostic logs for signs of unauthorized access or data modification.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.