Key points
- Progress MarkLogic Server versions before 11.3.7 and 12.1.0 contain a critical isolation vulnerability.
- The flaw, tracked as CVE-2026-9191, carries a CVSS score of 9.6 according to the NVD record.
- Attackers can execute unauthorized actions or compromise sessions through REST and XDBC evaluation paths.
Security teams must address a critical isolation flaw in Progress MarkLogic Server that allows session hijacking. The vulnerability, identified as CVE-2026-9191, affects versions 11.x before 11.3.7 and 12.x before 12.1.0. According to the National Vulnerability Database, the issue receives a CVSS score of 9.6, classifying it as critical. This high severity rating reflects the potential for significant unauthorized access.
In plain English
The core issue involves insufficient isolation of user-supplied code. When code runs through specific REST and XDBC evaluation paths, it does not remain separate from HTTP request, response, and session state. An attacker who can execute code through these affected paths may perform unauthorized actions. They can also compromise an already authenticated session, effectively taking over the user's context without needing new credentials.
The background
Progress Software Corporation produces the MarkLogic Server platform. The vulnerability stems from how the server handles code execution in certain interfaces. Specifically, the REST and XDBC paths fail to keep user-supplied code isolated from the surrounding session data. This lack of separation creates an avenue for attackers to manipulate session state. The flaw is mapped to CWE-346, which relates to insufficient isolation of resources.
What changes now
Organizations using affected versions face immediate risk if their servers are exposed to untrusted code execution. There is no confirmed patch mentioned in the current NVD record for versions prior to 11.3.7 and 12.1.0. However, the version numbering implies that updates to 11.3.7 and 12.1.0 likely resolve the issue. Security operations teams should verify their current versions against these thresholds to determine exposure.
What to do and how to stay safe: MarkLogic Server
- Inventory all MarkLogic Server instances to identify versions 11.x before 11.3.7 and 12.x before 12.1.0.
- Restrict access to REST and XDBC endpoints to trusted internal networks or authenticated users only.
- Monitor logs for unusual code execution patterns or unexpected session state changes on affected servers.
- Plan to upgrade to MarkLogic Server 11.3.7 or 12.1.0 once the vendor provides the necessary updates.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which MarkLogic Server versions are affected by CVE-2026-9191?
Versions 11.x before 11.3.7 and 12.x before 12.1.0 are affected by this vulnerability.
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns a CVSS score of 9.6 to CVE-2026-9191.
How can an attacker exploit this flaw?
An attacker can execute code through REST or XDBC evaluation paths to compromise authenticated sessions.
