Progress Software has disclosed 31 security flaws in MarkLogic Server, two of which are rated critical. These vulnerabilities could permit accounts with limited management privileges to escalate to full administrator control. Patches were released on September 10, 2026, for MarkLogic 11.3.7 and 12.1.0. Users are urged to update to the patched versions immediately.

What should defenders do?

Update MarkLogic Server to version 11.3.7 or 12.1.0 or later. Patches were released on September 10, 2026. Apply the updates immediately to close the privilege escalation vectors.

highVulnerability

Two Critical Privilege Escalation Flaws Discovered in Progress MarkLogic Server

CVE-2026-#### and CVE-2026-#### could allow delegated managers to attain persistent administrator control

Cyber.TechVoidPublished about 2 hours agoUpdated less than a minute ago1 min read

Two Critical Privilege Escalation Flaws Discovered in Progress MarkLogic Server

Key Takeaways

Progress Software disclosed 31 vulnerabilities in MarkLogic Server on October 12, 2026.
Two of the flaws are rated critical and could allow privilege escalation from delegated management roles to full administrator control.
Patches were released on September 10, 2026, for MarkLogic 11.3.7 and 12.1.0.

Related Security News

criticalvulnerability

Active Exploitation of Critical SSRF Flaw in SonicWall SMA 1000 Appliances

SonicWall SMA 1000 appliances are under active attack exploiting a critical Server-Side Request Forgery (SSRF) vulnerability. Threat actors are leveraging the flaw to interact with internal services, potentially enabling unauthorized access, data exfiltration, and lateral movement within affected networks. The vendor has acknowledged the active exploitation and urges immediate mitigation.

Dark readingabout 12 hours ago1 min read