Progress Software

Progress MarkLogic Server Patched for 10 Vulnerabilities Including Seven Critical Issues

Progress Software has released security updates for its MarkLogic Server database product after disclosing ten vulnerabilities, seven of which carry CVSS v3.1 base scores of 9.0 or higher. Three flaws, tracked as CVE-2026-7329, CVE-2026-8709, and CVE-2026-9193, were each rated 9.9 and allow low-privileged users to escalate rights or access restricted data. CVE-2026-7329 enables a user holding only a REST role to obtain administrator privileges through crafted queries, granting unauthorized operations on the database. CVE-2026-8709 stems from improper handling of REST document patches and similarly permits privilege escalation, while CVE-2026-9193 arises from insufficient access controls in the Hadoop integration feature. The advisory was published on 5 August 2026 and urges immediate application of the available patches.

Progress Software Urges Businesses to Immediately Shut Down ShareFile Storage Zone Controller Servers Over Credible External Threat

Progress Software has instructed customers to manually power down servers running ShareFile Storage Zone Controller due to a credible external threat, temporarily blocking affected accounts while an investigation is underway. The company has not disclosed the nature of the threat or any timeline for restoring access, and no evidence of unauthorized access to customer data has been found so far. Storage Zone Controller enables organizations to store and manage data in their own infrastructure or with third-party providers instead of relying solely on Progress-hosted services. Some users have speculated that the incident may be linked to two high-severity vulnerabilities patched in March, CVE-2026-2699 and CVE-2026-2701, which could allow unauthenticated attackers to modify controller settings, upload malicious files, and execute arbitrary commands. Progress Software is treating the server shutdown as an additional protective measure while the investigation continues, highlighting the seriousness with which the company views the potential risk.