# CVE-2026-9195: Progress MarkLogic Server cross-site scripting in Query Console

Source: https://junglewise.ai/threats/cve-2026-9195-progress-marklogic-server-cross-site-scripting-in-query-console  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-9195 · Severity: critical · CVSS 9.3 · Published 2026-08-05

MarkLogic Server is an enterprise database platform used to manage complex data. A cross-site scripting (XSS) vulnerability in the Query Console administrative interface allows an attacker to trick an authenticated administrator into visiting a malicious link, after which arbitrary JavaScript executes in the administrator's browser. This could lead to credential theft and unauthorized administrative actions, potentially compromising the entire database and customer data.

Technologies: [Progress Marklogic Server](https://junglewise.ai/threats/technologies/marklogic-server). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-9195 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9195 being exploited in the wild.

**How severe is CVE-2026-9195?** Critical severity, with a CVSS score of 9.3, published 5 August 2026.

**Which products and versions are affected?** Progress Marklogic Server before 11.3.6, before 12.0.3.

**Is there a fix for CVE-2026-9195?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9195 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-9195?** Check whether you run Progress Marklogic Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cross-site scripting (XSS) vulnerability exists in the Query Console component of Progress MarkLogic Server versions before 11.3.6 and 12.0.3. The vulnerability is triggered when a remote attacker crafts a malicious URL and lures an authenticated administrator to visit it. Upon navigation, unsanitized user input is reflected in the page and executed as JavaScript in the administrator's browser context. This allows the attacker to capture session credentials, perform administrative actions on the database, and potentially escalate privileges. No user interaction beyond clicking a link is required once the administrator is authenticated. Patches are available in MarkLogic Server 11.3.6 and 12.0.3 and later versions.

## Affected products

- Progress MarkLogic Server before 11.3.6, before 12.0.3

## Timeline

- 2026-08-05: disclosed

## References

- [https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026](https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026)

## Related threats

- [Progress MarkLogic Server HTTP response splitting in Query Console](https://junglewise.ai/threats/cve-2026-85976-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x)
- [Progress MarkLogic Server cleartext S3 transport default](https://junglewise.ai/threats/cve-2026-85975-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x)
- [Progress MarkLogic Server TLS hostname validation bypass](https://junglewise.ai/threats/cve-2026-85974-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x)
- [Progress MarkLogic Server cleartext cluster-management communications](https://junglewise.ai/threats/cve-2026-85973-progress-marklogic-server-12-x-releases-before-12-1-0-may-use)
- [Progress MarkLogic Server Kerberos authentication verification bypass](https://junglewise.ai/threats/cve-2026-85972-progress-marklogic-server-12-x-releases-before-12-1-0-and-11-x)