Progress MarkLogic Server Patched for 10 Vulnerabilities Including Seven Critical Issues
Progress Software has issued an update for its MarkLogic Server database product to address ten security vulnerabilities, seven of which are rated critical.
The company published its security advisory on 5 August 2026, revealing multiple issues that received CVSS v3.1 base scores of 9.0 or above. Three vulnerabilities stand out with scores of 9.9: CVE-2026-7329, CVE-2026-8709, and CVE-2026-9193.
Privilege Escalation via REST Interface
CVE-2026-7329 allows an attacker possessing only a low-privileged REST role to escalate to full administrator rights by submitting specially crafted queries. Successful exploitation grants the ability to perform privileged database operations and access data that would normally be restricted.
Two additional high-severity flaws further increase the risk surface. CVE-2026-8709 is caused by improper patch processing within the REST document interface and can be leveraged for unauthorized privilege escalation. CVE-2026-9193 affects the Hadoop integration module, where insufficient permission checks enable users to interact with the security database in ways that should be blocked.
Organizations running MarkLogic Server are strongly advised to apply the latest patches without delay to mitigate these critical risks.
Related articles
Certificate Transparency Logs Fail to Block Rogue CA Man-in-the-Middle Attacks
A detailed technical analysis reveals that Certificate Transparency logs do not effectively protect users from man-in-the-middle attacks carried out with certificates issued by compromised or sloppy certificate authorities. The author attempted to verify SCT entries from real browser certificates using public CT log APIs such as get-proof-by-hash but consistently received 404 Not Found responses. Tools including Windows certutil also reported every SCT as not found in the logs. A practical proof-of-concept attack was then constructed by creating a self-signed CA that exactly replicated the certificate chain of habr.com and serving it through nginx with matching extensions and attributes. The resulting MITM connection was accepted by browsers without warnings despite HSTS, because the pre-certificate in the log differs from the presented certificate only in public key bytes. A publicly accessible demonstration was deployed on Yandex Cloud allowing anyone to test the bypass by overriding DNS for habr.com.
Critical Vulnerabilities Disclosed in NVIDIA Dynamo with Remote Attack Risks
NVIDIA has released a security advisory detailing multiple vulnerabilities affecting its Dynamo software for Linux, which provides multimodal data serving capabilities. A total of 15 CVEs were identified across different versions, with the most severe being CVE-2026-24254 rated at CVSS 9.8 as Critical due to an out-of-bounds write in multimodal serving topology that allows unauthenticated remote attacks. Additional high-severity issues include CVE-2026-24253, which can cause denial of service through out-of-bounds memory writes, and CVE-2026-47623, which stems from deserialization of untrusted data leading to potential denial of service or data tampering, both scoring 8.2. The advisory notes a possible inconsistency between the reported CVSS base score and vector string that may be corrected later. Patches have been made available, and users are urged to update immediately to mitigate the risks.
CISA Adds JetBrains TeamCity CVE-2026-63077 to Known Exploited Vulnerabilities Catalog After Active Attacks
The US Cybersecurity and Infrastructure Security Agency has added a critical vulnerability in JetBrains TeamCity to its Known Exploited Vulnerabilities catalog due to confirmed exploitation in the wild. The flaw, tracked as CVE-2026-63077, stems from unsafe deserialization of untrusted data over the agent polling protocol and permits unauthenticated remote code execution. TeamCity is widely used for automating software build, test, and deployment pipelines in development environments. CISA directed all US federal agencies to apply vendor mitigations within three days, by August 8, 2026. Organizations running the continuous integration server are urged to review exposure and implement the recommended fixes immediately to prevent further compromise.
DLL Sideloading via version.dll in WinSCP: Search Order Exploitation, Rust Proxy and Payload Interception
WinSCP loads version.dll from its own directory because Windows searches for DLLs in a specific order starting with the application folder. Researchers demonstrated how to identify this library through the import table, Known DLLs exclusion, and Procmon monitoring to observe the loader attempting the AppDir path before falling back to SysWOW64. The same technique was recently used in campaigns targeting FileZilla via a fake domain and CPUID supply-chain compromises involving cryptbase.dll. A Rust-based proxy DLL forwards 14 exports via linker-level redirection while implementing three hijacked functions that trigger a MessageBox payload immediately upon WinSCP startup. The PoC was built for 32-bit WinSCP on Windows 11 using cargo and a generated .def file that adapts to x86 or x64 targets. This attack remains effective because version.dll is not listed in KnownDLLs and is directly imported by WinSCP, guaranteeing early execution before the main application window appears.