Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Progress disclosed 31 vulnerabilities in MarkLogic Server (fixed in 11.3.7 and 12.1.0), including five critical flaws that, given certain existing privileges, can allow persistent administrator creation, privilege escalation, or execution of server-side code; many other high-severity issues depend on configuration (SAML, OAuth, cloud hosting, logs, S3, Query Console, legacy components). The vendor recommends upgrading, reviewing delegated privileges and role assignments, and notes some behavior and compatibility changes in the fixes; there is no indication in the vendor notes or public catalogs that these flaws have been seen exploited in the wild.