Progress MarkLogic Server October 2026 security bulletin: 20 CVEs including unauthenticated SAML and OAuth token authentication bypasses (CVSS 7.5) and a JavaScript-engine use-after-free (8.0); fixed in 12.1.0 and 11.3.7
Progress Software, the CNA for MarkLogic, published 20 CVE records (CVE-2026-85957 to CVE-2026-85976) on 12 October 2026, all pointing to its MarkLogic Critical Security Alert Bulletin for October 2026. Every flaw is in MarkLogic Server, the enterprise multi-model database used for document and metadata-heavy workloads, and affects the 12.x releases before 12.1.0 and, for most of them, 11.x before 11.3.7. The items to read first are the unauthenticated network ones. In deployments using SAML, a remote attacker could get the server to accept an assertion it should reject (CVE-2026-85962, 7.5). A separate validation weakness lets the server accept a token it should refuse (CVE-2026-85958, 7.5). On 11.x, the SAML parser processes external DTDs and entities (XXE, CVE-2026-85957, 7.5). The deprecated OpsDirector component carries SSRF and a hard-coded key that an unauthenticated attacker could use to forge trusted requests (CVE-2026-85963, 7.5). Azure deployments may record security-sensitive data in logs (CVE-2026-85961, 7.5), and S3 connections may use cleartext transport (CVE-2026-85975, 7.5). Progress's top score is 8.0, for memory-safety defects in the JavaScript engine integration that a high-privileged attacker could use to corrupt memory (CVE-2026-85965). The rest include predictable Query Console CSRF tokens that could lead to server-side code running with a victim's permissions (CVE-2026-85960, 7.5), Query Console path traversal and information exposure (7.7), out-of-bounds read and write and a second XXE (7.1), Kerberos, TLS hostname and cluster-join transport weaknesses (7.4), world-readable log files (7.1), XSS (6.1) and response splitting (5.4). The CVE records do not mention exploitation or public exploit code. Primary: the Progress MarkLogic bulletin (October 2026) and the Progress-assigned CVE records (12 Oct 2026).
- Product
- Progress MarkLogic Server
- Versions
- Affected: 12.x before 12.1.0; 11.x before 11.3.7 for most CVEs (CVE-2026-85957 XXE is 11.x only; CVE-2026-85968 and CVE-2026-85973 are 12.x only). Fixed: 12.1.0 and 11.3.7.
- CVSS
- Top 8.0 (CVE-2026-85965); 7.5 for the unauthenticated SAML/OAuth/OpsDirector/XXE items (Progress, CVSS 3.1)
- Exploited in Australia?
- unknown
- Patch to
- Upgrade MarkLogic Server to 12.1.0 (12.x) or 11.3.7 (11.x). Until then: put Query Console and admin ports behind VPN or a management network, disable deprecated OpsDirector if it's still enabled, review SAML identity-provider trust and token settings, require TLS on S3 and cluster links, and tighten log file permissions.
Primary: Progress Community — MarkLogic Critical Security Alert Bulletin, October 2026 · Vendor: CVE record CVE-2026-85962 (assigner: Progress Software, published 12 Oct 2026) — MarkLogic SAML improper authentication · CVE: CVE-2026-85957, CVE-2026-85976, CVE-2026-85962, CVE-2026-85958, CVE-2026-85963, CVE-2026-85961, CVE-2026-85975, CVE-2026-85965, CVE-2026-85960 · CVE record CVE-2026-85965 (Progress Software) — MarkLogic JavaScript engine use-after-free, CVSS 8.0