MarkLogic privilege escalation chain reaches database admin from query access

MarkLogic's October 2026 patch fixed 31 vulnerabilities, including three rated CVSS 9.9 and two at 9.6. The chain lets a query-only account execute XQuery, create a persistent admin or take over via a deprecated management API. Fixes are in 12.1.0 and 11.3.7; the retired 10.x branch is unpatched.

• 31 vulnerabilities fixed, three at CVSS 9.9 and two at 9.6
• Affected versions: 12.0–12.0.3 and 11.0–11.3.6
• Fixed in 12.1.0 and 11.3.7; 10.x gets no patches
• ZoomEye found 4,545 internet-visible MarkLogic instances