CVE-2026-9191

Think of MarkLogic Server as a vault that runs custom instructions for different users. This flaw means the vault doesn't properly keep one user's instructions and session separate from another's, so a trickster who gets a legitimate user to interact with something malicious could step into that user's shoes and act on their behalf inside the system.

This matters to you if you run Progress MarkLogic Server for database, content, or application workloads — the issue affects 12.x versions before 12.1.0 and 11.x versions before 11.3.7. It's a real risk if the server's REST or XDBC interfaces are reachable by users or clients who could be induced to trigger the flawed code path (user interaction is required, not just background exposure).

This is rated critical severity because an attacker who gets a user to interact with a malicious request could fully hijack that user's session and take unauthorized actions in MarkLogic — a serious outcome for any database holding business data. No confirmed real-world attacks or public exploit code exist yet, and press coverage is only a roundup mention, not evidence of active abuse, but the severity and ease of triggering mean you should not wait to patch.

1. Inventory all MarkLogic Server instances and record exact version numbers across both 11.x and 12.x branches.
2. Confirm exposure by checking whether REST or XDBC evaluation endpoints are reachable by any client, internal or external, since UI:R means the attack requires a user to trigger a crafted request/response interaction.
3. Target fixed versions: upgrade the 11.x branch to 11.3.7 or later, or the 12.x branch to 12.1.0 or later — review Progress's release notes for the specific branch for any breaking changes before upgrading production.
4. If immediate patching isn't possible, restrict network access to REST/XDBC interfaces to trusted hosts only, and force re-authentication/session invalidation for all users as a temporary mitigation.
5. No CISA KEV listing exists and no public exploit is on record, so there is no mandated remediation deadline, but given the CVSS 9.6 score, prioritize this alongside your highest-severity patch cycle.
6. Monitor vendor advisories and threat intelligence feeds for any shift to confirmed exploitation, since rising press attention suggests researcher interest that could precede weaponization.

CVSS 3.1 score 9.6 (Critical), vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H — network-exploitable, low complexity, no privileges required, but requires user interaction and has a scope change affecting session-adjacent resources. Weakness is CWE-346 (Origin Validation Error/insufficient isolation) in REST and XDBC code-evaluation paths, allowing user-supplied code to improperly interact with HTTP request, response, and session state. Not listed in CISA KEV; no public exploit code exists; EPSS places exploitation likelihood in the lowest percentile with a flat trend, consistent with no observed in-the-wild activity. Press attention is rising per a roundup mention referencing actor 'Armory Castle,' but this reflects coverage, not confirmed exploitation. Exploit maturity: theoretical/PoC-absent at this time.