Progress SoftwareCVE-2026-9195

Progress Software MarkLogic Server: cross-site scripting

Critical9.3CVE-2026-9195 · Published Aug 5, 2026 · updated Sep 3, 2026

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.

Progress Software advisory

Affected versions

Package	Affected	Fixed in
MarkLogic Server Product	>= 11.0.0, < 11.3.6	11.3.6
	>= 12.0.0, < 12.0.3	12.0.3

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-22, CWE-79

More Progress Software advisories

All Progress Software

Date	Advisory	Severity	Fixed in
Aug 5	Progress Software MarkLogic Server: authentication bypass Critical9.8Aug 5 CVE-2026-919211.3.6+1 more	Critical9.8	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: privilege escalation Critical9.9Aug 5 CVE-2026-919311.3.6+1 more	Critical9.9	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: server-side request forgery High8.5Aug 5 CVE-2026-920311.3.6+1 more	High8.5	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: privilege escalation High8.1Aug 5 CVE-2026-732711.3.6+1 more	High8.1	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: privilege escalation Critical9.9Aug 5 CVE-2026-732911.3.6+1 more	Critical9.9	11.3.6+1 more
Aug 5	Progress Software MarkLogic Server: authentication bypass Critical9.1Aug 5 CVE-2026-755711.3.6+1 more	Critical9.1	11.3.6+1 more

Affected versions

More Progress Software advisories

Critical advisories by email