CVE-2026-85967: Cross-site scripting in Progress MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a remote attacker to execute script in the context of an authenticated user's browser session, which could result in unauthorized actions or disclosure of information accessible to that user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which MarkLogic Server versions need remediation?
The issue affects 12.x releases before 12.1.0 and 11.x releases before 11.3.7. Upgrade to 12.1.0 or later in the 12.x line, or 11.3.7 or later in the 11.x line.
What must an attacker do to exploit this issue?
An attacker can attempt exploitation remotely without privileges or prior authentication, but an authenticated user must interact with the malicious content. Successful exploitation runs script in that user's browser session.
What could an attacker gain through a successful exploit?
The attacker may perform unauthorized actions or obtain information that the affected authenticated user is allowed to access. The impact depends on the permissions of the user whose browser session is compromised.