EUVD-2026-53421
GHSA-64cx-qr5g-g4wf
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
C:L not C:H because CSRF cannot read cross-origin responses (SOP); I:H for direct security config modification; A:L as availability impact is indirect.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthorized changes to security configuration.
AnalysisAI
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote, unauthenticated attacker to trigger unauthorized administrative actions - including changes to security configuration - on behalf of an authenticated administrator who is deceived into visiting a malicious web page. Affected versions span the 11.x line before 11.3.6 and the 12.x line before 12.0.3, with fixes available from Progress Software. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target must be a MarkLogic administrator with an active, authenticated session in their browser at the time of the attack; (2) the attacker must successfully lure that administrator to a malicious web page - requiring a social-engineering step such as phishing, malvertising, or a compromised third-party site; and (3) the MarkLogic Admin UI must be reachable from the administrator's browser (i.e., not isolated to a separate network or management-only host). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 7.5, placing this in the High tier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a MarkLogic administrator via LinkedIn or public documentation, then sends a phishing email containing a link to a malicious webpage. The page includes JavaScript or an HTML form that silently submits a forged POST request to the MarkLogic Admin UI endpoint responsible for security configuration - for example, adding a new privileged user or modifying role assignments. … |
| Remediation | Upgrade MarkLogic Server to version 11.3.6 or later (for deployments on the 11.x line) or to 12.0.3 or later (for deployments on the 12.x line), per the Progress Software advisory at https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all MarkLogic Server instances and identify those running affected versions (11.x before 11.3.6 or 12.x before 12.0.3); confirm whether the Admin UI is network-accessible or exposed to untrusted users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Marklogic Server
View allPrivilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a l
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthentic
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote at
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged u
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user h
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today