# Progress discloses 31 MarkLogic flaws, including administrator takeover paths

_Published Tuesday, October 13, 2026 at 6:08 AM EDT · Security, Infrastructure · Latest · Tier 2 — Notable_

![Progress discloses 31 MarkLogic flaws, including administrator takeover paths — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvGRzVYOU1S12WE6ja5ZSrhInOGaNdwCGGwWch1oJn_SDtoy90ycGVjd-JeDjwSSH8XDzKlkoKsu_vlND1iW0aWJgEqf3Ti18goDI0yXeaLbF2DHrokj8Qdvm1kHEi8wqdm6_axRi17PVBqtlgFWLpZnv6Eufx_bFMkpWcnz6ymbQI4IDB7lgYi3QrZ7w/s1700-nu-rw-lo-l85-e365/amrk.jpg)

Progress Software disclosed 31 MarkLogic Server vulnerabilities on October 12, including two that could let accounts with limited management privileges take administrator control. Five flaws were rated critical; each requires an existing privilege or a way to run code on the server.

Fixes have been available since September 10 in versions 11.3.7 and 12.1.0. Releases 11.3.6 and 12.0.3, which fixed August's vulnerabilities, remain affected by the newly disclosed flaws.

Upgrading can disrupt existing automation: the fixes remove several features and tighten privilege checks. The 12.x line has no patched 12.0 release, requiring migration to 12.1.0. Existing diagnostic logs retain old permissions until rotated or recreated, and the Kerberos fix requires a keytab to perform its new check.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/two-critical-marklogic-flaws-could-give.html)

---
Canonical: https://techandbusiness.org/newswire/CS-cX0eaDdom4hKvxqAl6R
Published: 2026-10-13T10:08:35.865Z
Story chronology: 2026-10-12T00:00:00.000Z
Retrieved: 2026-10-13T13:19:09.913Z
Publisher: Tech & Business (techandbusiness.org)