Two Critical Mark Logic Flaws Could Give Delegated Managers Persistent Admin Control

Summary: Progress Software published 31 MarkLogic Server flaws on October 12, five of them critical, and two could let an account with only some management privileges take administrator control of the server. Fixes shipped September 10 in MarkLogic 11.3.7 and 12.1.0, and the fixes for the 10 flaws disclosed in August do not cover the new ones.
Key Takeaway: The fix for CVE-2026-85947 removes the ability of a forest-scoped administrative grant to attach a forest to a database of the account's choosing, and the records do not say whether upgrading removes an administrator account created through that flaw before the upgrade.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-85947 CVE-2026-85948 CVE-2026-85954 CVE-2026-85956 CVE-2026-85959 CVE-2026-9191 CVE-2026-9192
Related: ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026