Progress Software discloses 31 security vulnerabilities in its MarkLogic Server database platform, published on October 12, 2026. Five flaws are rated critical and, according to the National Vulnerability Database, there are 24 high-severity and two medium-severity issues. The CVSS scores reported for the critical items include multiple 9.9-rated vulnerabilities.
Progress says fixes are already available in MarkLogic 11.3.7 and 12.1.0, with the corresponding security updates released September 10. Installations on older patch lines—such as 11.3.6 or 12.0.3—remain exposed because they do not include the new fixes. Across coverage, the recurring theme is privilege escalation tied to delegated access: several critical issues can allow an account with limited management permissions to gain persistent administrator control, including via code execution paths. Separate guidance highlights that some post-upgrade behavior changes occur for evaluation and request/response handling on specific endpoints.
Outlets also note that the disclosed weaknesses do not require an unauthenticated attacker; they generally depend on an existing account or delegated privileges. One outlet reports there is no indication in public exploited-vulnerability catalogs as of October 13, though the CVE entries do not confirm whether real-world exploitation has occurred.
