CVE-2026-85967
6.1MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Remote attackers can execute arbitrary JavaScript in an authenticated user's session to steal data or perform actions on their behalf. This requires tricking the user into clicking a malicious link or interacting with a crafted payload.
Root cause
Improper neutralization of user-supplied input during web page generation allows cross-site scripting (CWE-79).
Affected systems
Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade MarkLogic Server to version 12.1.0, 11.3.7, or later. If patching immediately is not possible, restrict network access to the MarkLogic admin and application web interfaces.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a remote attacker to execute script in the context of an authenticated user's browser session, which could result in unauthorized actions or disclosure of information accessible to that user.