Vulnerability · Published Aug 5, 2026 · Assigned by ProgressSoftware

CVE-2026-9195Cross-site scripting in Progress MarkLogic Server Query Console

Critical 9.3

In plain English

A critical-severity cross-site scripting in MarkLogic Server from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)0.7%top 48.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.

Affected products (as reported)

Vendor	Product	Versions
Progress Software Corporation	MarkLogic Server	11.0.0 – before 11.3.612.0.0 – before 12.0.3

Weakness: CWE-79, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026 vendor-advisory