⚡ Renuntiatio

Duae Criticae Defectus MarkLogic Possunt Dare Delegatis Administratores Persistentes Imperium

📰 The Hacker News 🕐 Oct 13, 2026 08:44 ⏱ 4 minuta lectio ⚠️ 21 CVE

Duae ex 31 nuper revelatis defectibus in Progress Software's MarkLogic Server database permittunt rationem tantum quibusdam privilegiis administrationis datam capere imperium administratoris servorum, dicit societas.

Progress omnes 31 publicavit die 12 Octobris et quinque ex eis critica notavit. Emendationes ab die 10 Septembris praesto sunt, in MarkLogic 11.3.7 et MarkLogic 12.1.0.

Releases affectae, et emissio quae singulas emendationes corrigit:

MarkLogic 11.x ante 11.3.7: upgrade ad 11.3.7

MarkLogic 12.x ante 12.1.0: upgrade ad 12.1.0

MarkLogic 11.3 est linea sustentationis longae (LTS). Linea 12, quam Progress innovationis emissionem vocat, nullam 12.0 emendationem habet. Sua emendatio est 12.1.0, quae etiam novas functiones addit.

Instalatio emendationum pro 10 defectibus MarkLogic, quae Progress in Augusto revelavit, non satis est. Illae emendationes in 11.3.6 et 12.0.3 advenere, et utraque emissio a novis defectibus afficitur.

CVE recorda Progress et notas suas de upgrade pro duabus emissionibus non dicunt utrum aliquis ex 31 defectibus in impugnationibus usus sit. Nullus erat in catalogo Vulnerabilitatum Cognitarum Exploitatarum a U.S. Cybersecurity et Infrastructure Security Agency cum The Hacker News die 13 Octobris comprobavit.

Eadem recorda et nota nullum workaround pro clientibus qui nondum upgrade facere possunt indicant.

Quid Criticae Defectus Permittunt

Progress tres ex quinque defectibus criticis 9.9 ex 10 in scala CVSS notavit et alios duos 9.6. Pro unoquoque, impugnator iam privilegium habere debet aut modum ad codicem in servo currendum, secundum CVE recorda societatis.

Duae ex eis silvas implicant. In MarkLogic, silva est collectio documentorum quae ad database attachitur.

CVE

Punctum

Quid Impugnator Indiget

Quid Id Permittere Posset

CVE-2026-85947

9.9

Privilegia administrationis silvae

Creare rationem administratoris persistentem, potentia dando completum imperium administrativum servorum

CVE-2026-85948

9.9

Privilegia administrandi usoris

Obtine persistentem imperium administrativum, per defectum injectionis XQuery in via API Administrationis deprecata

CVE-2026-85955

9.9

Accessus ad exsecutionem quaestionum et privilegium xdmp-eval-in

Currere codicem servorum cum privilegiis elevatis

CVE-2026-85956

9.6

Privilegia administrandi database delegata

Sustentare aut restituere silvas extra suum database, permittendo accessum ad vel mutationes in id quod Progress vocat "data critica securitatis"

CVE-2026-9191

9.6

Facultas currendi codicem per certas vias aestimationis REST et XDBC

Perficere actiones non auctoritate aut compromittere sessionem authenticatam

Emendatio pro CVE-2026-85947 ostendit quae rationes in quaestione sunt. "Concessio administrativae silvae scopi" iam non satis est ad se attachere silvam ad database rationis electae, notae upgrade dicunt. Etiam dicunt clientibus ut recognoscant delegationes privilegii silvae et database ante upgrading, et ut auditent munera quae xdmp-eval-in tenent.

Investigatores externi quattuor ex quinque per Bugcrowd renuntiaverunt. Investigatrix usus manubrio rexnets creditur cum CVE-2026-85947, CVE-2026-85948, et CVE-2026-85956, et alius usus manubrio WaltWhitehat creditur cum CVE-2026-9191.

Defectus Qui a Configuratione Dependent

Progress 24 ex reliquis defectibus alte notavit et duo mediocriter. Altissimum, CVE-2026-85954, ad 8.6, posset sinere impugnatoris plura privilegia obtinere quam concessa per valores ad certas functiones XQuery transmittendo.

Plures ex aliis tantum applicantur ubi feature nominata aut platform in usu est:

SAML: In deploymentibus quae SAML authenticationem utuntur, impugnator remotus non authenticatus posset facere ut servus accipiat assertionem quam reicere debet (CVE-2026-85962). In 11.x, parser SAML etiam DTDs aut entitates externas processare potuit (CVE-2026-85957).

OAuth: Impugnator posset uti token quod servus non debet accipere (CVE-2026-85958). Emendatio addit issuer et audience probationes pro Ping Identity et aliis configurationibus OAuth.

Password-based Kerberos: In quibusdam configurationibus, impugnator in rete posito posset personare servitium authenticationis Kerberos (CVE-2026-85972).

Cloud hosting: Impugnator authenticatus posset accedere ad interna servitia nubis et obtinere credentia nubis in Azure (CVE-2026-85951) et in deploymentibus nubis basatis in Linux (CVE-2026-85952).

Diagnostic logs: Sub quibusdam configurationibus, servus posset scribere informationes sensibiles ad securitatem in logs diagnosticis (CVE-2026-85949 et, in Azure, CVE-2026-85961). Claves secretas AWS et sessionis tokens in plano textu scripta sunt cum via trace IAM affectata activata erat, notae upgrade dicunt.

Amazon S3: Conexiones ad S3 possent uti cleartext per default (CVE-2026-85975).

Query Console: Impugnator remotus qui usorem Query Console inlogatum ad aperiendum paginam malignam obtinet, poterat currere codicem servorum cum permissionibus illius usoris (CVE-2026-85960). Usor Query Console authenticatus poterat legere arbitrarias tabulas servorum (CVE-2026-85964).

Componentes vetusti: OpsDirector, feature deprecata, posset sinere impugnatoris remotus non authenticatus facere petitiones ad interna servitia aut falsificare petitiones fiduciales (CVE-2026-85963). Vetera InfoStudio moduli possent dare accessum ad tabulas servorum (CVE-2026-85953).

Reliqua includunt tres defectus securitatis memoriae, defectum scripting inter sites, HTTP responsum dividentem in Query Console, inaequalia TLS hostname probationes in nonnullis connexiones outbound, et cleartext traffic administrationis cluster in 12.x.

Quid Upgrade Mutat

Progress dicit clientibus ut legant notas suas de upgrade, notae incompatibilitatis notae pro 11.3.7 et illis pro 12.1.0, ante upgrading. Notae 11.3.7 indicant mutationes comportamentales ad 22 defectus pertinentes, et notae 12.1.0 ad 21.

Mutationes quae codicem, instrumenta, aut automationem existentem frangere possunt includunt:

mlcp: Versiones antiquae MarkLogic Content Pump (mlcp) contra novas emissiones cum errore XDMP-ISOLATED deficiunt. Progress commendat mlcp 11.3.7 aut 12.1.0. Versiones antiquae possunt currere cum -restrict_hosts set ad verum, quod potest reducere efficientiam.

Features remotae: API /manage/v2/packages, InfoStudio, et OpsDirector remotae sunt.

Novae defaults: XML processus externorum entitatum est off.

Vulnerabilitates Relatae

CVE-2026-85975 CVSS 7.5 HIGH Received

CVE-2026-85975 - Cleartext transmission in Progress MarkLogic Server Amazon S3 connections

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.

CVE-2026-85972 CVSS 7.4 HIGH Received

CVE-2026-85972 - Improper Kerberos server verification in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.

CVE-2026-85964 CVSS 7.7 HIGH Awaiting Analysis

CVE-2026-85964 - Path traversal in Progress MarkLogic Server Query Console

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files.

CVE-2026-85963 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85963 - Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information.

CVE-2026-85962 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85962 - Improper authentication in Progress MarkLogic Server SAML processing

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing. In deployments that use SAML authentication, an unauthenticated remote attacker could cause the affected server to accept an assertion that should be rejected, potentially resulting in unauthorized access.

CVE-2026-85961 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85961 - Sensitive information exposure in Progress MarkLogic Server Azure deployments

On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected cloud resources.

CVE-2026-85960 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85960 - Cross-site request forgery in Progress MarkLogic Server Query Console

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.

CVE-2026-85959 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85959 - Insufficient authentication logging in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which could limit customers' ability to detect and investigate unauthorized access or credential misuse.

CVE-2026-85958 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85958 - Improper OAuth token validation in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use a token that should not be accepted by the affected server, which could result in unauthorized access.

CVE-2026-85957 CVSS 7.5 HIGH Awaiting Analysis

CVE-2026-85957 - Improper XML external entity restriction in Progress MarkLogic Server SAML processing

Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure.

CVE-2026-9191 CVSS 9.6 CRITICAL Received

CVE-2026-9191 - Insufficient isolation of user-supplied code in Progress MarkLogic Server

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.

CVE-2026-85956 CVSS 9.6 CRITICAL Awaiting Analysis

CVE-2026-85956 - Improper privilege management in Progress MarkLogic Server backup and restore operations

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.

CVE-2026-85955 CVSS 9.9 CRITICAL Awaiting Analysis

CVE-2026-85955 - Improper privilege management in Progress MarkLogic Server xdmp:eval-in

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.

CVE-2026-85954 CVSS 8.6 HIGH Awaiting Analysis

CVE-2026-85954 - Improper privilege management in Progress MarkLogic Server higher-order XQuery functions

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain higher-order XQuery functions in an elevated security context, which could result in privilege escalation beyond the attacker's granted permissions.

CVE-2026-85953 CVSS 8.5 HIGH Awaiting Analysis

CVE-2026-85953 - Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity.

CVE-2026-85952 CVSS 8.5 HIGH Awaiting Analysis

CVE-2026-85952 - Server-side request forgery in Progress MarkLogic Server Linux cloud deployments

Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials.

CVE-2026-85951 CVSS 8.5 HIGH Awaiting Analysis

CVE-2026-85951 - Server-side request forgery in Progress MarkLogic Server Azure deployments

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentials or tokens.

CVE-2026-85949 CVSS 8.1 HIGH Awaiting Analysis

CVE-2026-85949 - Sensitive information exposure in Progress MarkLogic Server trace logs

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources.

CVE-2026-85948 CVSS 9.9 CRITICAL Awaiting Analysis

CVE-2026-85948 - Improper privilege management in Progress MarkLogic Server Management API

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.

CVE-2026-85947 CVSS 9.9 CRITICAL Awaiting Analysis

CVE-2026-85947 - Improper privilege management in Progress MarkLogic Server forest operations

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.

CVE-2026-9192 CVSS 9.8 CRITICAL Analyzed

CVE-2026-9192 - Authentication bypass in Progress MarkLogic Server ODBC App Server

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators.

Duae Criticae Defectus MarkLogic Possunt Dare Delegatis Administratores Persistentes Imperium

Vulnerabilitates Relatae

Plura ex The Hacker News