Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

What happened

Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control  Swati Khandelwal  Oct 13, 2026 Vulnerability / Web Security Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says.

Affected releases, and the release that fixes each: MarkLogic 11.x before 11.3.7: upgrade to 11.3.7 MarkLogic 12.x before 12.1.0: upgrade to 12.1.0 MarkLogic 11.3 is the long-term support (LTS) line. The 12 line, which Progress calls an innovation release, has no patched 12.0 release.

Its fix is 12.1.0, which also adds new features. Installing the fixes for the 10 MarkLogic flaws Progress disclosed in August is not enough.

Those fixes arrived in 11.3.6 and 12.0.3, and both releases are affected by the new flaws. Progress published all 31 on October 12 and scored five of them critical.

Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0 .