MarkLogic Patches 31 Database Flaws, Two Let Junior Admins Seize the Whole Server

Key points

• Progress Software disclosed 31 vulnerabilities in MarkLogic Server on 12 October, with five rated critical and two that let a user holding only partial management rights take over the whole database server.
• Patches have been available since 10 September in MarkLogic 11.3.7 and MarkLogic 12.1.0.
• None of the 31 flaws appear in CISA's Known Exploited Vulnerabilities catalog as of publication, meaning the US government has not yet seen them used in real attacks.
• MarkLogic is an enterprise database used by banks, insurers and government agencies to store large volumes of mixed records, so a hostile administrator could read or alter sensitive files at will.
• Threat Vectr's own tracking of ransomware leak sites has not recorded any victim claims tied to MarkLogic exploitation in the last 90 days.

Progress Software, the vendor behind the file-transfer tool MOVEit that was ransacked by the Clop gang in 2023, has published 31 security fixes for its MarkLogic Server database product. The disclosures went out on 12 October. Five are rated critical. Two of those are the ones worth your attention.

What do the worst two bugs actually do?

They let a user who was only meant to handle a slice of the database take full administrator control of the server. A junior staffer with a limited management login can promote themselves to the top of the system and do anything an administrator can, including reading every record and creating new accounts.

MarkLogic lets organisations hand out narrow management roles so that, for example, one team can manage backups and another can manage users without either having the keys to everything. These two critical flaws break that separation. A hostile insider, or an outsider who has phished one of those delegated accounts, keeps that elevated access until someone notices and strips it back.

Progress hasn't published technical write-ups of the two bugs beyond the advisory text, and no public exploit code has surfaced.

Who runs MarkLogic, and why does this matter?

MarkLogic is a commercial database aimed at large organisations that need to store messy, mixed data: contracts, claims files, intelligence records, patient notes. Its customer list skews toward banks, insurers, pharmaceutical firms and government agencies. The databases themselves tend to sit inside corporate networks rather than on the public internet, which lowers the risk of a drive-by attack but does nothing to stop an attacker who already has a foothold.

That's the scenario defenders should assume here. Someone phishes a mid-level database operator, or buys their credentials from an access broker, and then uses one of these flaws to graduate from "can manage one thing" to "owns the server". We've covered this pattern twice in recent months, including a September cPanel bug that let a single mail account take root control of a whole server.

What should administrators do now?

Upgrade to MarkLogic 11.3.7 or 12.1.0, both of which have been available since 10 September, a full month before the public disclosure. Progress gave customers that gap deliberately, which is the right call. It also means any organisation still on an older build in mid-October has had the fix sitting in the portal for weeks.

The advisory, first reported in detail by The Hacker News, doesn't list the finders of the two privilege-escalation bugs, which is unusual for a disclosure of this size.

Progress has had a rough three years on the disclosure beat. MOVEit, Telerik, and now a 31-bug drop in a single database product. Enterprise buyers who standardised on the company's stack are quietly running out of patience, and that's the story behind the story here.