CVE-2026-85976
5.4MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-113
Impact
Authenticated attackers can perform HTTP response splitting to trigger unintended client-side response handling or cross-site scripting against other users. Exploitation requires valid Query Console credentials and a victim to follow a malicious interaction.
Root cause
The Query Console file-exploration endpoint fails to sanitize user-supplied input before placing it into HTTP response headers.
Affected systems
Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade MarkLogic Server to version 12.1.0, 11.3.7, or later. If you cannot patch immediately, restrict network access to the Query Console port (typically port 8000) to trusted administrative IP addresses.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console file-exploration endpoint, which could allow HTTP response splitting and unintended client-side response handling.