MarkLogic Server Critical Security Alert: Multiple CVEs including RCE and SSRF

Vulnerability Overview The MarkLogic Critical Security Alert Bulletin - October 2026 reports multiple critical and high-severity security vulnerabilities involving unauthorized administration, authentication and session validation, server-side request forgery, sensitive information exposure, XML processing, and memory safety. These vulnerabilities could lead to unintended administrative actions, exposure of data or credentials, code execution, service disruption, or reduced auditability. Affected Scope MarkLogic Server 12.0 - 12.0.3: Affected by version, platform, feature, and configuration scope for each CVE. MarkLogic Server 11.0 - 11.3.6: Affected by version, platform, feature, and configuration scope for each CVE. MarkLogic Server 10.x and earlier: Not included in the full assessment; does not receive fixes. Remediation All customers are advised to upgrade to a supported fixed version as soon as possible. Specific fixed versions are as follows: MarkLogic Server 12.0 - 12.0.3: Upgrade to MarkLogic Server 12.1 MarkLogic Server 11.0 - 11.3.6: Upgrade to MarkLogic Server 11.3.7 MarkLogic Server 10.x and earlier: Upgrade to MarkLogic Server 12.1 or 11.3.7 Vulnerability Details 1. CVE-2026-8191 - CWE-346: Origin Validation Error - Description: MarkLogic Server versions 12.x and 11.x do not sufficiently isolate user-provided code execution, which could lead to unauthorized actions or session state manipulation. 2. CVE-2026-85947 - CWE-269: Improper Privilege Management - Description: MarkLogic Server versions 12.x and 11.x have an authorization vulnerability that could allow a remote attacker to create persistent unauthorized admin accounts. 3. CVE-2026-85948 - CWE-269: Improper Privilege Management - Description: MarkLogic Server versions 12.x and 11.x have an XQuery injection vulnerability that could allow a remote attacker to gain persistent unauthorized administrative control. 4. CVE-2026-85949 - CWE-532: Insertion of Sensitive Information into Log File - Description: MarkLogic Server version 12.x may log security-sensitive information in diagnostic logs, leading to unauthorized access. 5. CVE-2026-85950 - CWE-269: Improper Privilege Management - Description: MarkLogic Server versions 12.x and 11.x have an authorization vulnerability that could allow a remote attacker to access high-privilege associated authentication material. 6. CVE-2026-85951 - CWE-918: Server-Side Request Forgery - Description: MarkLogic Server versions 12.x and 11.x have a server-side request forgery vulnerability in Azure, which could lead to unauthorized access to cloud credentials. 7. CVE-2026-85952 - CWE-918: Server-Side Request Forgery - Description: MarkLogic Server versions 12.x and 11.x have a server-side request forgery vulnerability that could lead to unauthorized access to cloud credentials. 8. CVE-2026-85953 - CWE-22/CWE-269: Path Traversal and Improper Privilege Management - Description: MarkLogic Server version 12.x has path traversal and privilege management vulnerabilities that could lead to unauthorized access or execution. 9. CVE-2026-85954 - CWE-269: Improper Privilege Management - Description: MarkLogic Server versions 12.x and 11.x have privilege management vulnerabilities that could lead to privilege escalation. 10. CVE-2026-85955 - CWE-269: Improper Privilege Management - Description: MarkLogic Server versions 12.x and 11.x have privilege management vulnerabilities that could allow a remote attacker to execute code. 11. CVE-2026-85956 - CWE-269: Improper Privilege Management - Description: MarkLogic Server versions 12.x and 11.x have privilege management vulnerabilities that could lead to unauthorized access or modification. 12. CVE-2026-85957 - CWE-611: Improper Restriction of XML External Entity Reference - Description: MarkLogic Server version 11.x has an XML External Entity (XXE) reference vulnerability that could lead to unauthorized access or information disclosure. 13. CVE-2026-85958 - CWE-287: Improper Authentication - Description: MarkLogic Server versions 12.x and 11.x have an authentication vulnerability that could lead to unauthorized access. 14. CVE-2026-85959 - CWE-778: Insufficient Logging - Description: MarkLogic Server versions 12.x and 11.x have insufficient logging, which could lead to unauthorized access or credential abuse. 15. CVE-2026-85960 - CWE-352: Cross-Site Request Forgery - Description: MarkLogic Server versions 12.x and 11.x have a cross-site request forgery (CSRF) vulnerability that could lead to unauthorized actions. 16. CVE-2026-85961 - CWE-532: Insertion of Sensitive Information into Log File - Description: MarkLogic Server version 12.x may log security-sensitive information in diagnostic logs, leading to unauthorized access. 17. CVE-2026-85962 - CWE-287: Improper Authentication - Description: MarkLogic Server versions 12.x and 11.x have an authentication vulnerability that could lead to unauthorized access. 18. CVE-2026-85963 - CWE-918/CWE-321: Server-Side Request Forgery and U

Goal Reached Thanks to every supporter — we hit 100%!

MarkLogic Server Critical Security Alert: Multiple CVEs including RCE and SSRF