CVE Intelligence
Analysis AI-assisted

CVE-2026-9191: Insufficient isolation of user-supplied code in Progress MarkLogic Server

Progress MarkLogic Server has a critical flaw, CVE-2026-9191, in which user-supplied code run through certain REST and XDBC paths is not sufficiently isolated from HTTP and session state. The CNA scores it 9.6 under CVSS 3.1, and the affected ranges are from 11.0.0 before 11.3.7 and from 12.0.0 before 12.1.0. No confirmed exploitation appears in the sources consulted, and the record lists no fix entries.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-9191 affects Progress MarkLogic Server. The record describes insufficient isolation of user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response and session state. The CNA rates it critical with a CVSS 3.1 base score of 9.6.

Impact

  • The record states that an attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.
  • The CVSS vector indicates network attack vector, low complexity, no privileges required, user interaction required, scope changed, and high confidentiality, integrity and availability impact.
  • The SSVC data in the record rates technical impact as total and automatable as no.

Affected products and versions

  • Progress Software MarkLogic Server from 11.0.0 before 11.3.7.
  • Progress Software MarkLogic Server from 12.0.0 before 12.1.0.

The record contains no fix entries. Based on the affected ranges, versions at or after 11.3.7 in the 11 line and at or after 12.1.0 in the 12 line fall outside the stated ranges, but confirm against the vendor bulletin.

Exploitation status

The KEV listing is false. No confirmed exploitation appears in the sources consulted. EPSS for this record is 0.00207 probability with a 0.10286 percentile, dated 2026-10-23.

Remediation and mitigation

  • Review the vendor bulletin linked in the references and identify MarkLogic Server deployments in the affected ranges.
  • Plan upgrades to releases outside the affected ranges, prioritizing internet-reachable or multi-tenant environments.
  • Until patched, restrict access to REST and XDBC endpoints to trusted networks and accounts, and review session and authentication controls.

Detection guidance

  • Review server logs for unusual REST and XDBC evaluation requests, especially from unexpected sources or accounts.
  • Monitor for unexpected changes in authenticated session activity or administrative actions.

Limitations of the available information

The record does not include a CWE name, fix entries, or exploit details. The vendor bulletin was not analyzed in full for this content. Specific affected endpoints and configurations are not described beyond the REST and XDBC evaluation paths.

Frequently asked questions

Is CVE-2026-9191 being actively exploited?

The KEV listing is false, and no confirmed exploitation appears in the sources consulted. Monitoring should continue because the CVSS score is critical.

Which MarkLogic Server versions are affected?

The record lists the range from 11.0.0 before 11.3.7 and the range from 12.0.0 before 12.1.0. Confirm your exact build against the vendor bulletin.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.