Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesTwo MarkLogic Server vulnerabilities can let an authenticated, low-privileged REST user escalate privileges, but the available advisory records do not establish that either flaw creates a persistent administrator account. The Canadian Centre for Cyber Security’s August 5, 2026 advisory lists affected releases before 11.3.6 and 12.0.3. Administrators should verify their installed build, apply the applicable Progress update, and review REST write access.
What the MarkLogic advisories confirm
The Canadian Centre for Cyber Security’s advisory AV26-781, dated August 5, 2026, identifies Progress MarkLogic Server versions before 11.3.6 and before 12.0.3 as affected by a bulletin covering ten CVEs. It directs administrators to review the vendor bulletin and apply necessary updates. The advisory’s linked bulletin lists CVE-2026-7326, CVE-2026-7327, CVE-2026-7329, CVE-2026-7557, CVE-2026-8709, CVE-2026-9190, CVE-2026-9192, CVE-2026-9193, CVE-2026-9195, and CVE-2026-9203. Read the Canadian advisory.
As an Amazon Associate I earn from qualifying purchases.
Two of those records describe privilege escalation through REST-facing functionality. They identify separate attack surfaces and impacts; neither, in the available description, verifies persistent administrator-account creation or confirms exploitation in the wild.
How the two documented attack paths differ
| Issue | REST surface | Prerequisite stated in advisory | Described impact |
|---|---|---|---|
| CVE-2026-7329 | SQL, SPARQL, and Optic REST query interfaces | Authenticated user with a low-privileged REST role | Can escalate privileges to administrator, enabling privileged operations and unauthorized data access. |
| CVE-2026-8709 | REST API document patch operation | Authenticated low-privileged REST user | Can escalate privileges and execute privileged operations against the Security database. |
The wording matters: one record specifically describes escalation to administrator privileges, while the other describes privileged operations against the Security database. These are serious but distinct outcomes. The CVE-2026-8709 record assigns a CVSS v3.1 score of 9.9, a severity rating—not a measure of how often the flaw is exploited, how many systems are affected, or the odds that a particular deployment was compromised. See the CVE-2026-8709 record. The CVE-2026-7329 advisory is available in the GitHub Advisory Database.
#1 Best Overall
Does this prove delegated managers can retain admin control?
No. The cited records establish that low-privileged authenticated REST users can reach privileged capabilities through the specified interfaces. They do not establish that the vulnerabilities let delegated managers create a persistent administrator account, retain access after remediation, or that a particular deployment has been compromised. The available evidence also does not identify these two CVEs as the exact pair implied by the headline’s persistent-control claim.
Do not treat “privilege escalation” as proof of persistence. If you suspect exploitation, investigate using your organization’s incident-response process and the applicable Progress guidance; the records cited here do not specify indicators of compromise or a forensic procedure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What MarkLogic administrators should do
- Check the exact installed build. Compare it with the thresholds in AV26-781: releases before 11.3.6 and before 12.0.3 are listed as affected. Confirm the correct product branch and upgrade path with Progress documentation rather than assuming the version numbers are interchangeable.
- Apply the applicable vendor update. The Canadian advisory recommends necessary updates. Use Progress’s instructions for the specific installation and verify the resulting build after the upgrade.
- Review REST write privileges. CVE-2026-8709’s mitigation guidance recommends limiting REST API write privileges to accounts that need them and reviewing service accounts to remove unnecessary write access. Pay particular attention to accounts with access to document patch operations.
- Reassess low-privilege REST accounts. Inventory which users and service accounts can reach SQL, SPARQL, Optic, or document-patch REST functionality, then remove access that is not required for their duties.
Restricting write access reduces exposure, but it is not a substitute for applying the applicable update. The government advisory and CVE descriptions do not provide a confirmed exploitation count or indicate whether any specific MarkLogic installation has been attacked.
Recommended Free Tools
Quick Recap
Best Value
- Used Book in Good Condition
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
