[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4on7FzKlKRYUkFFNJMfiIqUEk7Ib7mrW1uqv78S5x2E":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"46af3fe3-9106-4b99-bcff-cf619f973aa5","marklogic-flaws-let-limited-users-seize-persistent-admin-control","f38bec44-c727-45ff-898d-01aed648780b","MarkLogic Flaws Let Limited Users Seize Persistent Admin Control","Two critical vulnerabilities in Progress Software's MarkLogic Server (CVSS 9.9) allow users with delegated management privileges to escalate their access and gain persistent administrator control — a severe violation of the principle of least privilege. The root issue lies in flawed privilege enforcement within the database platform, meaning trust boundaries between role types were not properly enforced. This matters because database administrators often hold the keys to an organization's most sensitive data, and a compromised delegated account could silently maintain elevated access long after the initial exploit. With patches available since September 10 in versions 11.3.7 and 12.1.0, organizations running older versions remain exposed to complete database takeover.","**Immediate Actions:**\n- Patch all MarkLogic Server instances to version 11.3.7 or 12.1.0 immediately.\n- Audit all delegated manager accounts to identify any suspicious privilege changes or unauthorized admin access.\n- Restrict network access to MarkLogic Server instances to trusted hosts only while patching is underway.\n\n**Access Control Hardening:**\n- Review and enforce least-privilege principles across all database user roles, removing any unnecessary delegated permissions.\n- Implement multi-factor authentication (MFA) for all accounts with elevated database privileges.\n- Enable comprehensive audit logging on privilege escalation events within MarkLogic Server.\n\n**Long-Term Improvements:**\n- Establish a formal patch management SLA that mandates critical patches (CVSS ≥ 9.0) be applied within 72 hours of release.\n- Integrate database assets into a continuous vulnerability scanning program to detect unpatched instances automatically.\n- Conduct periodic access reviews (at least quarterly) to validate that role assignments align with business need.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 4: Controlled Use of Administrative Privileges","CIS Control 7: Continuous Vulnerability Management","CIS Control 18: Application Software Security","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AU-9: Protection of Audit Information","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","GDPR Article 32: Security of Processing (where personal data is stored in MarkLogic)","ITIL Change Management: Emergency Change procedures for critical patches",{},"published","2026-10-13T10:20:46.739238+00:00","2026-10-13T10:20:46.693+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Ftwo-critical-marklogic-flaws-could-give.html","two-critical-marklogic-flaws-could-give-delegated-managers-persistent-admin-cont-81cc82","Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[51,55,59],{"slug":52,"name":53,"problem":54},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":56,"name":57,"problem":58},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":46,"name":60,"problem":61},"Automated patch management","Known holes get closed in days, not months."]