Barracuda Networks appointed Dan Fletcher as chief financial officer, adding a finance executive with experience in software businesses.Fletcher most recently served as CFO of Planful, where he helped triple revenue and integrate acquisitions. Previously, as CFO of MarkLogic, he led its transition to a software-as-a-service model and helped guide its sale to Progress Software. He also served as an operating principal at Vector Capital. Fletcher served on the board of LivePerson (Nasdaq: LSPN) through its recent sale to SoundHound AI and currently serves as lead independent director of Gappify.

Progressが提供するMarkLogic Serverには、複数の脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新することで解決します。詳細は、開発者が提供する情報を参照してください。

Progress fixed 31 MarkLogic Server flaws in 11.3.7 and 12.1.0, including two that could give delegated accounts persistent admin control.

Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0. Affected

Progress released urgent security updates for MarkLogic Server to fix a broad set of critical and high-severity flaws that could let attackers gain elevated access, create unauthorized administrator accounts, execute code on servers, steal credentials, and access protected data. The security alert, published on October 12, 2026, affects MarkLogic Server 12.0 through 12.0.3 and MarkLogic Server 11.0 through 11.3.6. Progress has released MarkLogic Server 12.1 and 11.3.7 to address the issues. Organizations running retired MarkLogic versions, including version 10 and earlier, should move to a supported fixed release because those versions were not fully assessed and will not receive fixes. The most serious MarkLogic flaws involve improper privilege management, where a user with limited access may be able to perform actions reserved for an administrator. CVE-2026-85947 affects forest-management operations and could let a remote user with forest-management permissions create a persistent, unauthorized administrator account. Progress MarkLogic Flaws Another issue, CVE-2026-85948, is an XQuery injection flaw in a deprecated Management API package path. A remote user with manage-user-level permissions could use the flaw to gain persistent administrative control. These weaknesses matter because a low-level account can become a long-term entry point into the database platform. CVE-2026-85955 may allow a user with query-execution access to invoke an XQuery evaluation function without the required extra privilege. Progress said this could result in server-side code execution with elevated permissions. CVE-2026-85960 also creates a code execution path through predictable cross-site request forgery tokens in Query Console. A malicious webpage could send unauthorized requests when opened by an authenticated Query Console user, causing server-side code to run with that user’s permissions. This pattern resembles other recent Progress product security issues, including the Progress OpenEdge AdminServer flaw that allowed authenticated users to inject operating-system commands through remote administration features. Cyber Security News has also reported on Progress ShareFile vulnerabilities that could be chained to obtain remote code execution on affected customer-managed deployments. Several vulnerabilities could expose cloud services and authentication material. CVE-2026-85951 affects Azure-based installations and could enable server-side request forgery, or SSRF, allowing an authenticated user to request internal cloud services and potentially obtain credentials or tokens. CVE-2026-85952 presents a similar risk on Linux systems. Progress also fixed CVE-2026-85962, an improper SAML authentication issue . In deployments that use SAML, an unauthenticated remote attacker could cause MarkLogic to accept an assertion that should have been rejected, opening a path to unauthorized access. Other notable issues include XML external entity processing flaws, path traversal weaknesses, sensitive data written to logs, unsafe TLS certificate hostname validation, and cleartext transport for certain cluster-management and Amazon S3 connections . The bulletin also lists memory-safety flaws that could cause process crashes, limited memory disclosure, or data modification. Progress strongly recommends upgrading MarkLogic Server 12.0–12.0.3 to version 12.1 and upgrading the 11.x branch through 11.3.6 to version 11.3.7. The vendor says Progress Data Cloud customers have already been patched. Administrators should review administrator accounts, forest-management permissions, Query Console access, REST and XDBC evaluation paths, authentication events, diagnostic logs, and unexpected outbound connections. The company warned that affected servers may operate normally and that missing indicators do not prove a system has not been compromised. Before upgrading, teams should back up content and security databases. Progress notes that MarkLogic Server does not support downgrades, so an upgrade cannot simply be reversed after installation. Older MarkLogic Content Pump clients should also be upgraded to versions that match MarkLogic Server 12.1 or 11.3.7. The large number of fixed flaws makes this more than a routine patch cycle. Organizations should prioritize exposed management interfaces, privileged MarkLogic users, cloud-connected deployments, and SAML-enabled environments when applying the vendor’s updates. Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs . The post Critical Progress MarkLogic Flaws Enable Remote Code Execution and Admin Takeover appeared first on Cyber Security News .

Progress disclosed 31 MarkLogic Server flaws, including critical vulnerabilities that could let users with limited privileges gain administrator control…

Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in MarkLogic 11.3.7 and MarkLogic 12.1.0. Affected

Op 12 oktober 2026 heeft Progress beveiligingsupdates uitgebracht voor MarkLogic Server. Deze updates dichten diverse kwetsbaarheden die aanvallers verschillende soorten ongeautoriseerde toegang kunnen verschaffen. Denk hierbij aan toegang met verhoogde rechten, het creëren van onbevoegde beheerdersaccounts, het uitvoeren van code op servers, diefstal van inloggegevens en toegang tot beschermde gegevens. De kwetsbaarheden treffen MarkLogic Server versies 12.0 tot en met 12.0.3 en versies 11.0 tot en met 11.3.6. Om deze kwetsbaarheden te verhelpen, heeft Progress de versies 12.1 en 11.3.7 van MarkLogic Server uitgebracht. Organisaties die oudere versies, zoals versie 10 en ouder, gebruiken,...

Haz clic para acceder al contenido completo.