Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow… (CVE-2026-85967)

CVE-2026-85967 is a cross-site scripting vulnerability affecting Progress MarkLogic Server 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. An attacker can exploit this vulnerability remotely without privileges or user interaction beyond triggering the vulnerability in an authenticated user's session. Successful exploitation could allow execution of arbitrary scripts in the victim's browser context, leading to unauthorized actions or information disclosure within the scope of that user's permissions.

The vulnerability enables remote attackers to execute arbitrary scripts in the context of authenticated users' browser sessions. This can result in unauthorized actions performed on behalf of the user or disclosure of sensitive information accessible to that user. There is no indication of impact on system availability. No known exploits in the wild have been reported.

A fix is available in Progress MarkLogic Server versions 12.1.0 and 11.3.7 and later. Users should upgrade to these or newer versions to remediate the vulnerability. No additional vendor advisory content is provided; therefore, patch status is confirmed by the version information in the description.