CVE-2026-9195 Overview
CVE-2026-9195 is a cross-site scripting (XSS) vulnerability in the Query Console of Progress MarkLogic Server. The flaw affects versions prior to 11.3.6 and 12.0.3. A remote attacker who lures an authenticated administrator to a crafted URL can execute arbitrary JavaScript in the administrator's browser session. Successful exploitation allows the attacker to capture credentials and perform privileged actions on the administrator's behalf. The vulnerability requires user interaction but no authentication from the attacker, and it crosses security boundaries once triggered.
Critical Impact
Attackers can hijack authenticated administrator sessions in the MarkLogic Query Console, steal credentials, and issue privileged database operations through the compromised browser context.
Affected Products
- Progress MarkLogic Server versions before 11.3.6
- Progress MarkLogic Server 12.x versions before 12.0.3
- Query Console administrative interface
Discovery Timeline
- 2026-08-05 - CVE-2026-9195 published to NVD
- 2026-08-05 - Last updated in NVD database
- August 2026 - Progress publishes MarkLogic Critical Security Alert Bulletin
Technical Details for CVE-2026-9195
Vulnerability Analysis
The Query Console is the administrative web interface used to author and execute queries against MarkLogic Server databases. The vulnerability stems from insufficient output encoding or input sanitization within the Query Console, allowing attacker-controlled JavaScript to render inside an authenticated administrator's browser session.
Because the payload executes with the administrator's session context, the attacker inherits the administrator's privileges within the Query Console. This includes issuing XQuery, JavaScript, SPARQL, or SQL statements against connected databases and modifying server configuration. The scope change reflected in the CVSS vector confirms that impact extends beyond the vulnerable component into the connected database tier.
Root Cause
The underlying weakness is classified as [CWE-22], reflecting improper neutralization of input used in generating web page output within the Query Console. Attacker-supplied data reaches the response body without adequate encoding, enabling reflected or stored script execution in the administrator's browser.
Attack Vector
Exploitation requires an attacker to craft a URL containing the malicious payload and deliver it to a target administrator through phishing, chat, or a compromised web page. When the authenticated administrator visits the URL, the injected JavaScript executes under the Query Console origin. The script can read session cookies, exfiltrate credentials, and issue authenticated requests to backend MarkLogic endpoints. Refer to the Progress Security Alert Bulletin for vendor technical details.
Detection Methods for CVE-2026-9195
Indicators of Compromise
- Query Console access logs containing unusual query string parameters with HTML tags, javascript: URIs, or encoded <script> fragments
- Outbound HTTP requests from administrator workstations to unfamiliar domains immediately after Query Console access
- Unexpected administrative queries or configuration changes originating from an administrator session shortly after clicking an external link
Detection Strategies
- Inspect web server and reverse proxy logs for Query Console requests containing script-like payloads in URL parameters or referer headers
- Correlate administrator browser telemetry with MarkLogic audit logs to identify sessions that executed unexpected privileged operations
- Deploy content security policy (CSP) reporting on the Query Console origin to surface script-source violations
Monitoring Recommendations
- Enable MarkLogic audit logging for administrative role activity and forward events to a centralized log platform
- Monitor for anomalous XQuery, SPARQL, or SQL execution patterns tied to administrator accounts outside of normal working hours
- Alert on new admin API tokens, role assignments, or user creation events following Query Console sessions
How to Mitigate CVE-2026-9195
Immediate Actions Required
- Upgrade MarkLogic Server to version 11.3.6, 12.0.3, or later as specified in the Progress bulletin
- Rotate administrator credentials and revoke active sessions after patching to invalidate any tokens that may have been captured
- Restrict Query Console network exposure to management networks or VPN-only access
Patch Information
Progress addresses the vulnerability in MarkLogic Server 11.3.6 and 12.0.3. Consult the Progress Security Alert Bulletin for the full list of fixed builds, download locations, and upgrade guidance.
Workarounds
- Disable the Query Console on production instances where it is not required for daily operations
- Enforce network-layer access controls that permit Query Console access only from trusted administrator workstations
- Train administrators to avoid clicking untrusted links while authenticated to the Query Console and to use separate browser profiles for administrative work
# Example: restrict Query Console (default port 8000) to a management CIDR using iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
