CVE-2026-9195 Progress Software Corporation CVE debrief

Who should care

Administrators and users of Progress MarkLogic Server, especially those with access to the Query Console, should be aware of this vulnerability and take immediate action to secure their systems.

Technical summary

The vulnerability exists in the Query Console of Progress MarkLogic Server versions before 11.3.6 and 12.0.3. It allows a remote attacker to execute arbitrary JavaScript in an administrator's browser session by luring them to a crafted URL. This can lead to credential capture and unauthorized actions by the attacker. The issue affects administrators and users with access to the Query Console, who should be aware and take immediate action to secure their systems. Evidence from the CVE record and NVD entry supports this assessment, though additional vendor or source information would enhance understanding.

Defensive priority

High priority due to critical severity and potential for significant impact.

Recommended defensive actions

• Apply the vendor-provided patches for MarkLogic Server versions 11.3.6 and 12.0.3 or later.
• Restrict access to the Query Console to minimize exposure.
• Implement additional security measures such as web application firewalls to detect and prevent similar attacks.
• Educate administrators on the risks of visiting untrusted URLs and the importance of secure browsing practices.
• Regularly review and update software to ensure the latest security patches are applied.

Evidence notes

Evidence is based on a CVE record and an NVD entry. The CVE description provides details on the vulnerability, and the NVD entry offers additional context. However, further information from the vendor or other sources would be beneficial for a comprehensive understanding.

Official resources