CVE-2026-9195 in MarkLogic Server
Summary
by MITRE • 08/05/2026
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
This cross-site scripting vulnerability exists within the Query Console functionality of Progress MarkLogic Server versions prior to 11.3.6 and 12.0.3, representing a critical security flaw that enables remote code execution through browser-based attack vectors. The vulnerability specifically targets authenticated administrator sessions and exploits a weakness in how the application handles input validation within its query interface component. Attackers can craft malicious URLs that, when visited by an authenticated administrator, trigger javascript execution within the victim's browser context. This particular flaw falls under CWE-79 which categorizes cross-site scripting vulnerabilities as weaknesses in input validation and output encoding where user-supplied data is not properly sanitized before being rendered in web pages.
The operational impact of this vulnerability extends far beyond simple script execution, as it provides attackers with complete administrative control over affected systems. When an administrator visits a maliciously crafted URL, the javascript code executes within their privileged browser session, enabling credential theft through session hijacking techniques. The attacker can capture authentication tokens and cookies that maintain the administrator's elevated privileges, allowing them to perform any action available to the legitimate user including modifying database content, altering system configurations, creating new administrative accounts, or extracting sensitive data from the MarkLogic server. This represents a severe privilege escalation vulnerability that transforms a simple web-based attack into a comprehensive system compromise.
The attack vector relies on social engineering tactics where an attacker must successfully lure an authenticated administrator to visit a malicious URL, making this vulnerability particularly dangerous in environments where administrators frequently interact with external systems. The exploitation process demonstrates characteristics aligned with ATT&CK technique T1566 which involves phishing and social engineering to gain initial access. Organizations running vulnerable MarkLogic server versions face significant risk as the attack requires minimal technical sophistication beyond crafting a malicious URL, yet can result in complete system compromise. The vulnerability affects the core administrative interface of the database server, making it an attractive target for attackers seeking persistent access to enterprise data systems.
Mitigation strategies should prioritize immediate patching of affected MarkLogic Server installations to versions 11.3.6 or 12.0.3 where the XSS vulnerability has been addressed through proper input validation and output encoding mechanisms. Network segmentation and access controls should be implemented to limit administrator exposure to untrusted web environments, while security awareness training can help prevent successful social engineering attacks. Additional protective measures include implementing content security policies that restrict script execution within the Query Console interface, monitoring for suspicious URL patterns in administrator browser sessions, and maintaining comprehensive logging of administrative activities for anomaly detection. Organizations should also consider disabling or restricting access to the Query Console from external networks where possible, as the vulnerability specifically targets authenticated sessions that are typically accessible through internal administrative interfaces.