From Query Access to Root of the Database: Inside the MarkLogic Privilege Escalation Chain Privilege escalation is rarely a single step. In MarkLogic Server before the October 2026 fixes, several vulnerabilities offered starting points that were unusually close to the finish line. Vulnerability overview The bulletin fixed 31 vulnerabilities across MarkLogic Server. Three carry CVSS v3.1 scores of 9.9: CVE-2026-85947, CVE-2026-85948 and CVE-2026-85955. Two carry 9.6: CVE-2026-...