CVE-2026-85967

Cross-site scripting in Progress MarkLogic Server

State: Published
Severity: 6.1 Medium
Published: Oct 12, 2026
Updated: Oct 15, 2026
Reserved: Sep 4, 2026

Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a remote attacker to execute script in the context of an authenticated user's browser session, which could result in unauthorized actions or disclosure of information accessible to that user.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	ProgressSoftware

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation

Affected Products

Product	Versions
MarkLogic ServerProgress Software Corporation	11.0.0 to before 11.3.7Affected 12.0.0 to before 12.1.0Affected

References

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.