Progress MarkLogic Server CVE-2026-9191

Exploitation requires reaching MarkLogic's REST Client API or XDBC evaluation paths that run user-supplied code (e.g. eval/invoke-style endpoints) on affected builds (12.x before 12.1.0, 11.x before 11.3.7); the flaw is that this executed code is not isolated from the HTTP request, response, and session state. Limiting factors: the attacker must be able to execute code through one of these specific evaluation paths (in default MarkLogic these endpoints require authentication and evaluation privileges), and UI:R indicates a victim with an authenticated session must interact/trigger the path for session compromise to occur. It is not a background, zero-touch exploit against an arbitrary default install; the affected evaluation interface must be reachable and in use.

Vendor-assigned CVSS 3.1 is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), driven largely by the scope change (S:C) and full CIA impact. However, the signals are internally tense: the vector claims PR:N (no privileges), yet the description states the attacker must be 'able to execute code through an affected path' - in MarkLogic the REST/XDBC evaluation endpoints normally require authentication and eval privileges, which argues for PR:L rather than PR:N. CWE-346 (Origin Validation Error) plus UI:R and 'compromise an authenticated session' point to a confused-deputy / session-riding pattern where a victim with an active session is abused, rather than a purely anonymous RCE. No EPSS score, SSVC decision data, KEV listing, or POC was provided, so exploitation likelihood cannot be quantified from the input - there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a genuine high-severity flaw in a database platform and should be patched promptly given the critical vendor rating, but the 9.6 likely overstates real-world ease of exploitation because user interaction and some level of evaluation access are prerequisites. Verify PR and the exact privilege prerequisites with Progress before treating this as an unauthenticated internet-facing RCE.

An attacker who can submit code through MarkLogic's REST Client API or XDBC evaluation paths crafts a request whose executed code is not isolated from the surrounding HTTP request, response, and session context. By inducing an authenticated user to trigger the affected path (UI:R), the attacker's code bleeds into that session's state, letting them hijack or manipulate the authenticated session and perform actions beyond their own security context (S:C). No public exploit code was identified at time of analysis.