Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed… (CVE-2026-9191)

CVE-2026-9191 affects Progress MarkLogic Server 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. The issue arises because user-supplied code executed through specific REST and XDBC evaluation paths is insufficiently isolated from HTTP request, response, and session state. This lack of isolation can enable an attacker with code execution capability in these paths to carry out unauthorized actions or compromise authenticated sessions. The vulnerability is classified under CWE-346 (Origin Validation Error) and has a CVSS v3.1 score of 9.6, indicating critical impact on confidentiality, integrity, and availability.

An attacker able to execute code through the affected REST or XDBC evaluation paths could perform unauthorized actions or compromise an authenticated session. This could lead to full system compromise, data exposure, or disruption of service due to the high impact on confidentiality, integrity, and availability.

A fix is available in Progress MarkLogic Server versions 12.1.0 and 11.3.7 and later. Users should upgrade to these versions or later to remediate this vulnerability. Since this is not a cloud service, remediation requires applying the vendor's official patches. Patch status is confirmed by the version boundaries stated in the advisory.