Progress fixes 31 MarkLogic Server vulnerabilities including CVSS 9.9 privilege escalation

Progress disclosed 31 vulnerabilities in MarkLogic Server on October 12, 2026, with the most severe carrying a CVSS 9.9 score. The bulletin covers privilege escalation that lets delegated accounts reach full admin persistence, server-side code execution, authentication bypass, credential exposure, and data compromise. Updates are MarkLogic 12.1 and 11.3.7. The vendor explicitly warns that affected instances may run normally without any prior signs of exploitation, which removes the usual pre-breach indicators defenders rely on.

This is not a routine patch cycle. Thirty-one flaws in a single enterprise data platform, including a near-maximum privilege escalation path, mean any exposed MarkLogic instance is a direct route to persistent admin control and data compromise. The delegated-account vector is especially damaging because it turns partially trusted internal identities into full platform owners, bypassing separation of controls that enterprises assume protects backend data stores. The bulletin covers 31 distinct weaknesses, not a single CVE, so patching must be comprehensive rather than selective. There is no mention of active exploitation telemetry yet, but the absence of prior signs means defenders should not wait for an intrusion alert before acting.

Patch to MarkLogic 12.1 or 11.3.7 immediately. Restrict administrative interfaces to management networks and disable delegated-account privileges where they are not strictly required. Hunt for authentication anomalies and unexpected admin-level access in MarkLogic audit logs; the events mention no specific log paths, so focus on privilege-change events and credential-access patterns around the October 12 bulletin date. Monitor the vendor bulletin for additional fixes, since 31 flaws suggest the surface area may not be fully mapped in one release.

Watch for Progress to expand the advisory with specific CVE assignments or exploitation confirmation, and for CISA or vendor KEV additions that would confirm in-the-wild use. Any update that names exploited instances would shift this from a preemptive hardening story to an active incident response requirement.