Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Progress Software disclosed 31 vulnerabilities in MarkLogic Server, with five rated critical. Two of the critical flaws could allow accounts with only delegated manager privileges to gain full administrator control of the server. All 31 vulnerabilities were published on October 12, 2026. Patches were made available on September 10, 2026, in MarkLogic versions 11.3.7 and 12.1.0. Organizations using affected versions are advised to update immediately to prevent unauthorized privilege escalation.