MarkLogic Server EUVD-2026-53421

Requires an authenticated Progress MarkLogic Server administrator to visit an attacker-controlled malicious webpage while their Admin UI session is active in the same browser. The Admin UI must be reachable from the administrator's browser to the MarkLogic server (default port 8001). No non-default server configuration is required; all default installations of affected 11.x and 12.x versions are vulnerable. Exploitation is bounded by the mandatory social-engineering step (phishing or redirect of an active administrator) and does not succeed if the administrator uses separate browser profiles for administrative versus general browsing, or if modern SameSite cookie restrictions are already enforced.

The CVSS 8.8 score reflects a genuine high-severity flaw: network-accessible, low complexity, no attacker privileges required, with potential full compromise of C:H/I:H/A:H. However, several signals attenuate operational urgency. EPSS sits at just 0.14% (4th percentile), indicating very low current exploitation probability relative to the broader vulnerability population. SSVC assessment corroborates this: exploitation status is 'none' and the attack is not automatable, which directly reflects the mandatory social-engineering step - an administrator must actively visit a malicious page. No KEV listing and no public POC exist at time of analysis. The CVSS UI:R metric is the key limiting factor: this is fundamentally a phishing-dependent attack, not a direct network exploit. That said, the SSVC Technical Impact of 'total' is accurate - a successful CSRF against the Admin UI could enable security-configuration changes that cascade into full server compromise, and even a mid-sized municipal IT team in zabrze relying on MarkLogic for document or records management should treat patching as a near-term priority rather than deferring it. The overall risk profile is: real severity if exploited, low likelihood of opportunistic mass exploitation, but meaningful exposure in targeted-attack scenarios against administrators.

An attacker identifies a MarkLogic Server deployment and crafts a webpage containing hidden HTML forms or JavaScript that silently submit forged requests to the MarkLogic Admin UI - for example, creating a new administrator account or modifying role assignments. The attacker sends a convincing phishing link to a known MarkLogic administrator; when the administrator clicks the link while their Admin UI session is active in the same browser, the browser automatically includes their session cookie with the forged request, and the malicious action executes without the administrator's awareness. No public POC has been identified, but the technique requires no exploit sophistication beyond standard CSRF construction.