Executive Summary
Progress Software disclosed 31 security vulnerabilities in MarkLogic Server on October 12, 2026, with five rated critical. Two of the most severe flaws (CVE-2026-85947 and CVE-2026-85948) allow accounts with limited management privileges to escalate to persistent administrator control of the database server. CVE-2026-85947 enables forest-management accounts to create persistent admin accounts, while CVE-2026-85948 exploits an XQuery injection flaw in deprecated Management API paths. The vulnerabilities affect MarkLogic 11.x before 11.3.7 and 12.x before 12.1.0, with fixes available since September 10, 2026. The disclosure follows another batch of 10 critical flaws published in August 2026, indicating an ongoing pattern of privilege escalation vulnerabilities in enterprise database platforms that require immediate attention from organizations relying on MarkLogic for mission-critical data management.
Why This Matters Now
Enterprise database platforms are increasingly targeted for privilege escalation attacks that can compromise entire data infrastructures. With 31 vulnerabilities disclosed in just 68 days, organizations must prioritize immediate patching to prevent unauthorized administrative access to critical database systems.
Attack Path Analysis
Attackers exploited critical MarkLogic Server vulnerabilities (CVE-2026-85947, CVE-2026-85948) to escalate from delegated administrative privileges to persistent full administrative control. They leveraged forest-management and manage-user privileges to create backdoor administrator accounts, then used elevated permissions to access security-critical data across databases and potentially exfiltrate sensitive information through compromised administrative sessions.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers gained access to MarkLogic Server with delegated administrative privileges, specifically forest-management or manage-user level access
Related CVEs
CVE-2026-85947
CVSS 9.9A privilege escalation vulnerability in Progress MarkLogic Server allows users with forest-management privileges to create persistent administrator accounts and gain complete administrative control of the server.
Affected Products:
Progress Software MarkLogic Server – < 11.3.7, 12.x < 12.1.0
Exploit Status:
no public exploitCVE-2026-85948
CVSS 9.9An XQuery injection vulnerability in a deprecated Management API path allows users with manage-user-level privileges to gain persistent administrative control of Progress MarkLogic Server.
Affected Products:
Progress Software MarkLogic Server – < 11.3.7, 12.x < 12.1.0
Exploit Status:
no public exploitCVE-2026-85955
CVSS 9.9A privilege escalation vulnerability in Progress MarkLogic Server allows users with query-execution access and xdmp-eval-in privilege to run server-side code with elevated permissions.
Affected Products:
Progress Software MarkLogic Server – < 11.3.7, 12.x < 12.1.0
Exploit Status:
no public exploitCVE-2026-85956
CVSS 9.6A privilege escalation vulnerability allows users with delegated database-administrator privileges to back up or restore forests outside their own database, enabling access to security-critical data.
Affected Products:
Progress Software MarkLogic Server – < 11.3.7, 12.x < 12.1.0
Exploit Status:
no public exploitCVE-2026-9191
CVSS 9.6A vulnerability in REST and XDBC evaluation paths allows attackers with code execution capabilities to perform unauthorized actions or compromise authenticated sessions.
Affected Products:
Progress Software MarkLogic Server – < 11.3.7, 12.x < 12.1.0
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Valid Accounts: Local Accounts
Exploitation for Privilege Escalation
Event Triggered Execution
Create Account: Local Account
Server Software Component: Web Shell
Command and Scripting Interpreter: JavaScript
OS Credential Dumping
Impair Defenses: Disable or Modify Tools
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Configuration Standards for System Components
Control ID: 2.2.1
NYDFS 23 NYCRR 500 – Risk Assessment
Control ID: 500.09
DORA – Identification
Control ID: Article 8
CISA Zero Trust Maturity Model 2.0 – Privileged Identity Management
Control ID: Identity-2
NIS2 Directive – Cybersecurity Risk Management
Control ID: Article 21.2(a)
ISO 27001:2022 – Management of Technical Vulnerabilities
Control ID: A.8.8
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
MarkLogic database vulnerabilities enable privilege escalation to persistent admin control, threatening transaction systems, customer data integrity, and regulatory compliance requirements.
Health Care / Life Sciences
Critical MarkLogic flaws risk unauthorized access to patient databases, electronic health records, and research data, violating HIPAA compliance frameworks.
Government Administration
Database privilege escalation vulnerabilities could compromise sensitive government data repositories, citizen information systems, and critical administrative infrastructure security controls.
Information Technology/IT
MarkLogic server vulnerabilities directly impact IT infrastructure providers managing client databases, requiring immediate patching to prevent administrative control compromise.
Sources
- Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Controlhttps://thehackernews.com/2026/10/two-critical-marklogic-flaws-could-give.htmlVerified
- MarkLogic Server 11.3.7 Release Noteshttps://docs.progress.com/bundle/marklogic-server-whats-new-11/page/topics/release-notes.htmlVerified
- MarkLogic Server 12.1.0 Release Noteshttps://docs.progress.com/bundle/marklogic-server-whats-new-12/page/topics/release-notes.htmlVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would be highly relevant to this MarkLogic Server attack as it could have significantly constrained lateral database access and reduced the blast radius of privilege escalation across the infrastructure.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Zero trust fabric would likely have established baseline visibility into administrative session behavior and restricted initial access scope to explicitly authorized MarkLogic resources
Control: Zero Trust Segmentation
Mitigation: Microsegmentation policies would likely have constrained the ability to escalate from forest-level privileges to full administrative control across the entire MarkLogic infrastructure
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely have prevented unauthorized database access by blocking inter-forest communication that violated established security policies and access boundaries
Control: Multicloud Visibility & Control
Mitigation: Comprehensive visibility controls would likely have detected anomalous administrative account creation patterns and restricted server-side code execution through the Query Console interface
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policies would likely have constrained large-scale data extraction by monitoring and controlling outbound data flows from MarkLogic servers to unauthorized destinations
While administrative control was achieved, zero trust controls would likely have reduced the overall blast radius and limited the scope of database manipulation to segmented infrastructure zones
Impact at a Glance
Affected Business Functions
- Database Management Systems
- Data Analytics Platforms
- Enterprise Content Management
- Application Development Infrastructure
Estimated downtime: N/A
Estimated loss: N/A
Critical vulnerability disclosure affects MarkLogic Server database systems with potential for unauthorized administrative access, privilege escalation, and access to security-critical data across enterprise database deployments. No confirmed exploitation reported.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access controls and prevent delegated administrators from accessing resources outside their authorized scope
- • Deploy Inline IPS (Suricata) capabilities to detect and block exploit attempts targeting known CVEs like the critical MarkLogic vulnerabilities
- • Enable Multicloud Visibility & Control to monitor for anomalous administrative activities and suspicious privilege escalation patterns across database systems
- • Establish Egress Security & Policy Enforcement to prevent unauthorized data exfiltration from compromised administrative accounts
- • Deploy Cloud Native Security Fabric (CNSF) for real-time inspection and autonomous detection of privilege abuse and unauthorized administrative actions
