Cross-Site Scripting Vulnerability in Progress MarkLogic Server
CVE-2026-85967

6.1MEDIUM

Key Information:

Vendor

Progress Software
Status
Marklogic Server
Vendor
CVE Published:
12 October 2026

What is CVE-2026-85967?

The Progress MarkLogic Server versions 12.x prior to 12.1.0 and 11.x prior to 11.3.7 are susceptible to a cross-site scripting vulnerability. This flaw enables remote attackers to inject malicious scripts, which can be executed in the context of an authenticated user's browser session. The implication is potentially grave, as it may allow attackers to perform unauthorized actions or gain access to sensitive information that the user can access.

Affected Version(s)

MarkLogic Server 11.0.0 < 11.3.7

MarkLogic Server 12.0.0 < 12.1.0

References

https://community.progress.com/s/article/Marklogic-Critic...
vendor-advisory

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

backslash via Bugcrowd
.