Malik Haidar stands at the intersection of high-stakes data integrity and corporate resilience, having spent years navigating the labyrinthine security architectures of some of the world’s largest multinational firms. His approach to cybersecurity is rarely just about the code; it is about the synthesis of business intelligence and defensive strategy, ensuring that a company’s “crown jewels”—its data—remain shielded from increasingly sophisticated lateral movements. With the recent disclosure of thirty-one vulnerabilities within Progress Software’s MarkLogic Server, Malik provides a crucial perspective on why these flaws represent a significant shift in the database security landscape. Our discussion covers the nuances of forest-management exploitation, the risks of legacy components in modern environments, and the logistical hurdles of maintaining long-term support versus innovation-focused release cycles.
The recent disclosure of thirty-one flaws in MarkLogic Server has sent ripples through the security community, particularly regarding how administrative control can be seized. How is it possible for a user with limited forest-management privileges to escalate their authority into a persistent administrator account?
To understand this, you have to look at the architectural definition of a “forest” within the MarkLogic ecosystem. In this environment, a forest is essentially a collection of documents attached to a database, and the vulnerability labeled CVE-2026-85947 exploited a logic flaw in how these attachments were verified. Essentially, an account that was granted a “forest-scoped administrative grant”—which is supposed to be a restricted, delegated privilege—could bypass its intended boundaries and attach a forest to any database of their choosing. This might sound like a simple clerical error in permissions, but it’s a catastrophic failure of isolation that allowed for a CVSS score of 9.9. By manipulating this connection, an attacker could effectively plant their own administrative credentials within the system. What makes this particularly haunting for a security lead is that the account created is persistent; it doesn’t vanish when the session ends. It sits there, a silent back door into the heart of the enterprise’s data, and Progress has been very clear that even after you apply the 11.3.7 or 12.1.0 patches, you still need to manually audit your roles. The patch prevents new exploits, but it doesn’t necessarily evict an intruder who already walked through that open door.
Beyond the forest-level vulnerabilities, we see critical scores associated with XQuery injection in deprecated API paths. What does this tell us about the hidden risks lurking in legacy codebases that many organizations assume are inactive?
It’s a classic case of “out of sight, out of mind” becoming a massive liability. CVE-2026-85948 specifically targeted a deprecated Management API path, proving that just because a feature is no longer the primary way of doing things doesn’t mean it isn’t a viable entry point. An attacker only needed manage-user-level privileges to trigger an XQuery injection, which again leads to that dreaded 9.9 CVSS score and persistent administrative control. This highlights a fundamental truth in my work: legacy modules like OpsDirector or InfoStudio, which were actually removed in these latest updates, are often the softest targets because they don’t always receive the same rigorous auditing as the “innovation” features. When we see researchers like the one known as “rexnets” uncovering flaws in these older paths, it serves as a wake-up call. Organizations often hold onto these legacy components for compatibility with older automation scripts, but the price of that convenience is a surface area that remains vulnerable to server-side code execution. If you are still running MarkLogic 11.x versions prior to 11.3.7, you are essentially operating with a target on your back because these deprecated paths are still active and exploitable.
Cloud-based deployments have their own unique set of headaches, particularly with the recent leaks of credentials on Azure and AWS. How did these diagnostic and logging features become a liability rather than a tool for transparency?
It’s an ironic twist when a tool designed for troubleshooting becomes the primary source of a security breach. We saw this with CVE-2026-85951 and CVE-2026-85952, where authenticated attackers could pivot into internal cloud services to scrape credentials on both Azure and Linux-based deployments. Perhaps the most visceral example involved the IAM trace path; when enabled, the server was writing AWS secret keys and session tokens into diagnostic logs in plaintext. Imagine a developer trying to fix a minor query error, only to inadvertently dump the keys to the entire kingdom into a log file. To make matters worse, these logs, such as ErrorLog.txt and AuditLog.txt, were historically created with 0666 permissions—meaning they were world-readable. Even after the upgrade, those old files keep their permissive settings until they are rotated or manually adjusted to the new 0640 standard. This creates a “toxic tail” of data where sensitive secrets might be sitting in a plain text file on a server, just waiting for anyone with basic access to read them. It’s a stark reminder that security isn’t just about the firewall; it’s about how every single line of diagnostic data is handled and stored.
The logistical side of this update seems particularly thorny, with Progress Software warning about “breaking changes.” How should a business leader balance the need for immediate security with the risk of breaking their existing automation and tools?
This is where the rubber meets the road for a multinational corporation. The upgrade to 11.3.7 or 12.1.0 isn’t a “click and forget” operation; it’s a surgery. For instance, the MarkLogic Content Pump, or mlcp, will flat-out fail with an XDMP-ISOLATED error if you’re using an older version against the new server releases. This forces a synchronized upgrade of your entire toolchain. Then you have the changes to privileges; the xdmp:eval-in() function now requires a dual-privilege check—both xdmp-eval-in and xdmp-eval—which could break hundreds of existing internal applications overnight. There’s also the removal of the /manage/v2/packages API. For a company that has built its entire deployment automation around those APIs, this patch represents a significant project, not just a maintenance window. However, when you weigh that against the fact that a remote attacker could use a malicious page to run code via the Query Console, as seen in CVE-2026-85960, the choice becomes clear. You have to accept the operational friction because the alternative is an unmitigated compromise. The fact that Progress skipped a patched 12.0 release and moved straight to 12.1.0 shows that even they recognized that a clean break was necessary to address these structural flaws.
We’ve seen two major batches of vulnerabilities from Progress in just over two months, totaling forty-one CVEs. Does this frequency indicate a deteriorating security posture, or is it a sign of a more aggressive and healthy internal auditing process?
It’s a bit of both, but I lean toward the latter. When we see thirty-one flaws drop just sixty-eight days after a batch of ten, it shows a massive investment in clearing out the “security debt” that has accumulated over the years. Remember, the August batch included CVE-2026-9192, a 9.8-rated flaw that let unauthenticated attackers bypass password verification entirely on the ODBC App Server. That is the kind of vulnerability that keeps you awake at 3:00 AM. The current batch of thirty-one, four of which were reported through Bugcrowd, indicates that Progress is finally opening the hood and letting outside researchers find the deep-seated issues. The 32-day gap between the release of the fix and the public disclosure of the CVEs is also a tactical move—it gives the biggest, most vulnerable clients a head start on patching before the blueprints for the exploits become public knowledge. While it looks alarming to see forty-one CVEs in such a short window, I’d much rather see a company acknowledge and fix these than have them sit undiscovered in the NVD for another decade. The reality is that MarkLogic has been a black box for a long time, and we are finally seeing the light being shined into its most neglected corners.
One of the more subtle but dangerous flaws mentioned was the failure of the server to record successful logins in the audit log. In your experience, how does this specific type of “blindness” complicate the post-breach investigation?
CVE-2026-85959 is a nightmare for forensic analysts. If you can’t trust your audit log to record successful logins, you lose the ability to differentiate between a legitimate employee doing their job and an intruder who has stolen credentials. In my work with multinationals, the “dwell time”—the period between an initial breach and its discovery—is the most critical metric. If an attacker spends three weeks inside your system and your logs don’t show their entry points, you have no way to perform an accurate blast-radius assessment. You’re left wondering which documents were viewed, which forests were touched, and whether or not they exported your entire intellectual property library. Progress noted that this flaw limited the ability to detect credential misuse, which is essentially the “Get Out of Jail Free” card for a sophisticated hacker. It highlights that security isn’t just about preventing entry; it’s about the integrity of the evidence you need to clean up the mess afterward. Without a reliable audit trail, you are essentially flying blind in a storm.
What is your forecast for database security management?
I expect we will see a permanent shift toward “Security by Default” where features like XML external entity processing and plaintext S3 connections, which were disabled or changed in these latest MarkLogic updates, are no longer even options in enterprise software. The days of prioritising “out-of-the-box” ease of use over hardened configurations are over; in the next two years, the industry will move toward a model where every administrative action, like forest attachment or backup/restore, requires granular, multi-factor authorization that is checked against every single database object it touches. We are moving away from the era of the “all-powerful database admin” and into an era of zero-trust data management, where even the most privileged accounts are constantly being re-verified in real-time. This will undoubtedly increase the complexity of database administration, but as these thirty-one vulnerabilities have shown us, the cost of simplicity is a price that modern enterprises can no longer afford to pay. Organizations that don’t adapt to this more rigorous, audited way of operating will find themselves increasingly unable to secure their most sensitive assets against the relentless tide of delegated-privilege escalations.
