Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. (CVE-2026-85960)
Description
Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 contain a vulnerability where the Query Console uses predictable CSRF tokens. This flaw allows a remote attacker to trick an authenticated user into submitting unauthorized requests, potentially executing server-side code with the user's permissions. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85960 affects Progress MarkLogic Server 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. The vulnerability arises from the use of predictable Cross-Site Request Forgery (CSRF) tokens in the Query Console. An attacker can exploit this by luring an authenticated user to a malicious webpage, causing unauthorized requests to be submitted with the victim's privileges, potentially leading to execution of server-side code. This vulnerability is classified under CWE-352 (Cross-Site Request Forgery).
Potential Impact
Successful exploitation allows remote attackers to perform unauthorized actions on behalf of authenticated users in the Query Console, including executing server-side code with the victim's permissions. This can lead to full compromise of the affected server's confidentiality, integrity, and availability.
Mitigation Recommendations
A fix is available in Progress MarkLogic Server versions 12.1.0 and 11.3.7 and later. Users should upgrade to these or newer versions to remediate the vulnerability. Patch status is confirmed by the version boundaries specified in the description. No additional mitigation guidance is provided in the input data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-j7p7-v8q4-992x
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-85960"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acd553a2cdf04f656da8326
Added to database: 10/12/2026, 21:46:34 UTC
Last enriched: 10/12/2026, 21:50:48 UTC
Last updated: 10/13/2026, 03:48:07 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.