MarkLogic Server CVE-2026-9195

Exploitation requires that a victim who is an already-authenticated MarkLogic administrator opens an attacker-crafted URL pointing at the Query Console; the attacker themselves needs no account (PR:N) but cannot succeed without this administrator interaction (UI:R). Concretely limiting factors: the target must have an active authenticated session in the Query Console, the console must be reachable from where the admin clicks, and the affected version must be pre-11.3.6 or pre-12.0.3. There is no availability impact and no server-side pre-authentication access - the attack is entirely a client-side script-execution pivot through the admin's browser.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N drives the 9.3 (Critical) score primarily through the scope change (S:C) and high confidentiality/integrity impact - an XSS that pivots into the admin session justifiably crosses a security boundary. However, PR:N combined with UI:R is the key nuance: the attacker needs no privileges, but exploitation is fully contingent on social-engineering an authenticated administrator into clicking a crafted link, which materially lowers real-world exploitability versus a no-interaction RCE. No EPSS score, KEV entry, or POC was provided, so probabilistic and in-the-wild signals are absent. Net assessment: a genuinely serious admin-session-takeover bug, but its realistic risk is gated by the need for admin interaction and access to the Query Console, making it a high-priority patch rather than an internet-wide worming threat.

An attacker crafts a malicious URL targeting the MarkLogic Query Console and delivers it to an administrator via phishing or a watering-hole link. When the logged-in admin opens it, injected JavaScript runs in their authenticated session, silently exfiltrating session credentials and issuing privileged queries or configuration changes to the database. No public exploit was identified at time of analysis, but the reflected-XSS pattern is straightforward to weaponize once the vulnerable parameter is known.