{"id":"CVE-2026-9191","published":"2026-10-12T16:17:08.223","lastModified":"2026-10-15T16:27:17.070","description":"Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-346"],"vendors":[],"products":[],"references":[{"url":"https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to execute arbitrary code within the context of user sessions by bypassing input sanitization in REST and XDBC evaluation paths. This can lead to unauthorized actions or complete session compromise.","exploitability":"Exploitation is moderately difficult requiring an authenticated session with access to REST/XDBC endpoints, but the attack surface is broad enough that it could be leveraged by attackers with limited privileges.","blast_radius":"The impact could be severe across multiple user sessions and data access points since the vulnerability allows code execution in the context of authenticated users, potentially leading to widespread data compromise or unauthorized administrative actions.","remediation":"Upgrade to MarkLogic Server 12.1.0 or 11.3.7 to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","session","code-execution"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:47:59.404Z"}}