CVE-2026-85967 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a remote attacker to execute script in the context of an authenticated user's browser session, which could result in unauthorized actions or disclosure of information accessible to that user.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The identified security flaw resides within Progress MarkLogic Server versions 12.x prior to release 12.1.0 and version 11.x prior to release 11.3.7, representing a critical cross-site scripting vulnerability in the web-based administrative interface or application endpoints served by the platform. This type of vulnerability typically arises when the server fails to adequately sanitize user-supplied input before including it in dynamically generated content sent back to the client browser. In this specific context, an attacker can inject malicious scripts that are then executed within the security context of a legitimate, authenticated user's session. The core technical failure involves insufficient validation or encoding mechanisms for data inputs such as query parameters, form fields, or HTTP headers, allowing script payloads to bypass standard filtering rules and persist in the rendered HTML response.
From an operational perspective, this vulnerability poses a severe risk because it leverages the trust that users have in their browser sessions with MarkLogic Server. Once authenticated, users often possess elevated privileges or access sensitive data repositories managed by the server. By exploiting this cross-site scripting flaw, a remote attacker can execute arbitrary JavaScript code on behalf of the victim user without requiring additional authentication steps beyond convincing the user to visit a crafted URL or interact with malicious content hosted elsewhere. This capability effectively bypasses same-origin policy protections, allowing the attacker to perform actions that the authenticated user is authorized to perform, such as modifying configuration settings, querying sensitive data stores, or initiating administrative commands within the MarkLogic environment.
The impact of this vulnerability extends beyond simple script execution and encompasses significant potential for unauthorized information disclosure and system compromise. Attackers can utilize techniques like session hijacking by stealing cookies containing authentication tokens, thereby gaining full control over the victim's account without needing to crack passwords. Furthermore, the attacker may be able to exfiltrate sensitive data visible within the application interface or manipulate user inputs in real-time to trick users into performing unintended actions, such as transferring funds if financial modules are integrated or altering database queries that return confidential information. This aligns with CWE-79, which classifies improper neutralization of input during web page generation, and maps directly to MITRE ATT&CK techniques involving client-side code injection for credential access and data exfiltration.
To mitigate this risk, organizations running affected versions must immediately upgrade Progress MarkLogic Server to version 12.1.0 or later if operating on the 12.x branch, or to version 11.3.7 or later if on the 11.x branch. These releases contain patches that implement stricter input validation and output encoding practices to prevent script injection. In addition to upgrading, administrators should enforce Content Security Policy headers where applicable to restrict the sources from which scripts can be loaded and executed. It is also advisable to review access logs for any signs of exploitation attempts and ensure that all administrative interfaces are protected by strong authentication mechanisms such as multi-factor authentication to reduce the impact if a session token is compromised. Regular security assessments and penetration testing should be conducted to verify that input sanitization controls remain effective against evolving attack vectors.