CVE-2026-85960: falha de alta gravidade em Progress Software Corporation MarkLogic Server
Cross-site request forgery in Progress MarkLogic Server Query Console
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.2%
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Progress Software Corporation · MarkLogic ServerCVEs relacionadas — Progress Software Corporation MarkLogic Server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-9192CRITICALAuthentication bypass in Progress MarkLogic Server ODBC App ServerEPSS 0.8%CVE-2026-9190CRITICALHTTP request smuggling in Progress MarkLogic ServerEPSS 0.7%CVE-2026-9195CRITICALCross-site scripting in Progress MarkLogic Server Query ConsoleEPSS 0.7%CVE-2026-85955CRITICALImproper privilege management in Progress MarkLogic Server xdmp:eval-inEPSS 0.6%CVE-2026-7329CRITICALPrivilege escalation in Progress MarkLogic Server REST query interfacesEPSS 0.6%CVE-2026-85961HIGHSensitive information exposure in Progress MarkLogic Server Azure deploymentsEPSS 0.5%