MarkLogic Server EUVD-2026-97561

Exploitation requires a victim who is an actively authenticated MarkLogic Server user (typically an administrator or developer using the web-based Admin/Query console) to interact with attacker-supplied content - clicking a crafted link or loading a malicious page - per UI:R in the CVSS vector. The attacker needs no credentials of their own (PR:N) and no special server configuration is cited in the description, but the requirement for user interaction plus an existing authenticated session is the key limiting factor. Only versions 12.x before 12.1.0 and 11.x before 11.3.7 are affected; upgrading past those fixed releases removes exposure.

This is a moderate-severity reflected/DOM cross-site scripting flaw (CWE-79) with a CVSS 3.1 base score of 6.1 and vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The network attack vector and low complexity make delivery easy, and PR:N means the attacker themselves need no account, but the mandatory UI:R (user interaction) is the dominant limiting factor - a legitimate authenticated MarkLogic user must be lured into clicking a crafted link or loading malicious content for the script to execute in their session. Impact is bounded to Low/Low confidentiality and integrity with no availability effect, scoped (S:C) to the victim's browser authority rather than the server itself. No EPSS probability, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this reads as a real-but-not-urgent hygiene issue rather than a top-priority emergency. One data note: the source reference is titled a 'Critical Security Alert Bulletin,' which conflicts with the CVSS Medium (6.1) rating - verify the vendor's own severity rating against NVD, as the bulletin may be a bundle covering multiple issues of which this is only one.

An attacker crafts a malicious URL or payload targeting the MarkLogic Server web interface and delivers it to an authenticated user via phishing or a malicious link. When the victim opens it in an active session, attacker-controlled script executes in their browser, letting the attacker perform actions or read data as that user. No public exploit code was identified at time of analysis, and success depends on the victim interacting with the crafted content (UI:R).