CVE-2026-9195 - Cross-site scripting in Progress MarkLogic Server Query Console

Back Back to CVE browser

CRITICAL

Cross-site scripting in Progress MarkLogic Server Query Console

Published Aug 5, 2026

9.3

CRITICAL

CVSS 3.1

EPSS 0.65%

Description

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.

Affected products

Vendor Progress Software Corporation Product MarkLogic Server Default
unaffected
- Version
  11.0.0
  Status
  affected
  Constraints
  <11.3.6
- Version
  12.0.0
  Status
  affected
  Constraints
  <12.0.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Progress Software Corporation

MarkLogic Server

unaffected

Version	Status	Constraints
11.0.0	affected	<11.3.6
12.0.0	affected	<12.0.3

Remediation

Vendor solution

Restrict network access to the App-Services port (8000) to trusted networks. Configure a reverse proxy or web application firewall to reject malformed paths, including paths containing encoded path traversal sequences or multiple leading slashes. Users should avoid opening untrusted links while authenticated to Query Console.

Weaknesses (2)

CWE-22

Path Traversal

CWE-79

Cross-site Scripting (XSS)

References (2)

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026
vendor-advisoryVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53430
Advisory

Link	Providers	Tags
https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026		vendor-advisoryVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53430		Advisory