Progress published a critical security bulletin for MarkLogic Server on 12 October covering 31 vulnerabilities — by the National Vulnerability Database's count, filed by Progress itself: five critical, twenty-four high, two medium.

Thirty-one at once is a batch, not an incident. What makes it worth reading is what the worst of them have in common, and what the fix costs.

The theme is delegated administrators

MarkLogic has a granular privilege model: you can give somebody forest management, or database administration, or user management, without making them an administrator. Four of the serious flaws end the same way — that person becomes one.

  • CVE-2026-85947 — a holder of forest-management privileges can create a persistent unauthorised administrator account.
  • CVE-2026-85948 — an XQuery injection in a deprecated Management API path gives a manage-user-level account persistent administrative control.
  • CVE-2026-85956, scored 9.6 — delegated database-administrator privileges can back up or restore forests outside the attacker's own database.
  • CVE-2026-85954, scored 8.6 — passing values to certain XQuery functions yields more privilege than was granted.

That is not four unrelated bugs. It is a privilege model that did not hold at four separate boundaries, and the practical reading is that on an unpatched instance, a delegated role should be treated as equivalent to an administrator.

Three more in the batch are worth naming. CVE-2026-85955 lets query-execution access invoke an evaluation function without the privilege that was supposed to gate it. CVE-2026-85962 is a SAML flaw letting unauthenticated attackers submit assertions that should have been rejected. CVE-2026-85960 is predictable CSRF tokens in the Query Console.

The patch takes things away, and says so

Here is the sentence that makes this unusual. Progress warns that after upgrading, you may no longer have privileges you previously had, because that access was incorrect.

Vendors do not normally say that. The fix is not only closing holes; it is withdrawing access that people are using today, in production, because the privilege model was wrong and the correction is visible.

The rest of the upgrade notes carry the same warning in other forms. Older versions of the content-pump tool fail with an isolation error. The Kerberos login fix requires a keytab file. Existing log files keep their old permissions until they are rotated.

So this is a project, not a patch window. Somebody has to find out which jobs run under which delegated role, and which of those stop working on purpose.

No workaround, and one line with no fix at all

Progress lists no workaround for customers who cannot upgrade yet. The fixes are in 11.3.7 and 12.1.0.

The 12.0 line has no patch. Remediation there means moving to 12.1.0 — a minor-version move rather than a point release, with whatever testing that implies.

And the August releases, 11.3.6 and 12.0.3, are affected by the new flaws, so being current as of two months ago is not a defence.

Progress also notes that an affected instance may operate normally with no prior sign of exploitation, which is a polite way of saying that nothing in your monitoring will tell you.

What the reporting disagrees about

Two things worth checking against the bulletin rather than any summary, this one included.

Coverage differs on which flaws are the headline persistent-administrator pair — some name CVE-2026-85947 and CVE-2026-85948, others point at CVE-2026-85956 as the delegated-DBA issue. All three are real; the ranking is not consistent.

And the dates do not line up. One account says the fixed builds shipped on 10 September, a month before the 12 October bulletin. If that is right it is its own story, and it is the same shape as a pattern we have written about elsewhere: a fix that exists for weeks before anyone is told what it fixes. We have not been able to confirm it, so it stays here rather than in the body.

What to do

  • Upgrade to 11.3.7 or 12.1.0. If you are on 12.0, plan the move to 12.1.0; there is nothing else.
  • Before upgrading, inventory who holds delegated roles — forest management, database administration, user management — and what automation runs under them. Some of it will stop.
  • Treat delegated roles on an unpatched instance as administrator-equivalent until it is patched.
  • Rotate the Query Console sessions and anything that could have been reached through the SAML path.
  • Read Progress's bulletin for the authoritative CVE list. Thirty-one is too many to triage from coverage.

What is not established

  • Whether any of the 31 has been exploited. Progress does not say.
  • When the fixed builds actually shipped. Accounts differ by a month.
  • Which of the privilege-escalation flaws is the most serious in practice, as distinct from by score.
  • How many deployments run a 12.0 release with no patch available to them.
  • What proportion of real deployments actually use delegated roles, which is what decides how much of this matters.