MarkLogic Server EUVD-2026-97674

Exploitation requires a victim who is an actively authenticated user of MarkLogic Server's Query Console with a live session, and the attacker must lure that user to an attacker-controlled web page (user interaction is mandatory). The core enabling condition is the predictable CSRF token in Query Console, which lets the attacker's page forge requests that pass CSRF validation; without session hijacking this rides the victim's existing authenticated session. Limiting factors: only MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 are affected, the attacker cannot act without social-engineering an authenticated user (so unattended servers or users not currently logged into Query Console are not exploitable this way), and the high attack complexity (token prediction plus session timing) further narrows practical exploitation.

This is a credible but conditional risk rather than a drop-everything emergency. The CVSS 3.1 vector (7.5, AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) tells a coherent CSRF story: the attacker needs no credentials of their own (PR:N), but exploitation hinges on social engineering an already-authenticated Query Console user into visiting a malicious page (UI:R) and on the high-complexity preconditions of predicting/forging the CSRF token and timing the request against a live session (AC:H). The HIGH triad for confidentiality, integrity and availability is justified because Query Console can run server-side code, so a successful forgery executes code with the victim's permissions. No EPSS score, KEV listing, or public POC was provided in the input, and exploitation status is therefore 'no public exploit identified at time of analysis' - the only source is the Progress vendor bulletin. The combination of required user interaction, high attack complexity, and absence of any exploitation signal means this is a real but moderate-priority issue: patch on a normal cadence, prioritize where privileged users regularly use Query Console. Note the vendor advisory is titled 'Critical Security Alert' while the CVSS base score is 7.5 (High, not Critical) - this labeling mismatch should be verified against the vendor's own severity rating.

An attacker crafts a malicious web page and lures a MarkLogic administrator who is currently logged into Query Console into visiting it. Because Query Console uses predictable CSRF tokens, the page can forge a valid request that runs attacker-chosen server-side code under the victim's session and permissions. No public exploit code was identified in the provided data, so this requires the attacker to independently weaponize the predictable-token weakness and succeed against a live authenticated session.