CVE-2026-85960
Received Received - Intake

Predictable CSRF Tokens in Progress MarkLogic Server

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Progress Software Corporation

Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-85960
EUVD
EUVD-2026-97674

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Progress Software Corporation MarkLogic Server 11.0.0
Progress Software Corporation MarkLogic Server 12.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Progress MarkLogic Server versions before 12.1.0 and 11.3.7. It involves predictable Cross-Site Request Forgery (CSRF) tokens in Query Console. An attacker can trick an authenticated user into visiting a malicious page, which then submits unauthorized requests to the server. This could allow the attacker to execute server-side code with the victim's permissions.

Detection Guidance

Detecting this vulnerability requires checking if your MarkLogic Server version is affected. Query the server version via the admin interface or logs. Look for use of Query Console with authenticated sessions. Monitor for unauthorized requests or unusual server-side code execution patterns.

Impact Analysis

If you use Progress MarkLogic Server versions before 12.1.0 or 11.3.7, an attacker could exploit this to perform unauthorized actions on your server. This might include accessing sensitive data, modifying server settings, or executing malicious code with your user permissions. The impact depends on the victim's access level.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized code execution or data exposure could result in legal penalties, reputational damage, and loss of trust. Organizations must address this to maintain compliance.

Mitigation Strategies

Upgrade MarkLogic Server to version 12.1.0 or later for 12.x releases, or 11.3.7 or later for 11.x releases. Disable Query Console if not needed. Restrict access to authenticated users only. Implement network-level protections to block malicious page interactions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85960. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart