CVE-2026-7326

Published: Aug 5, 2026Modified: Sep 3, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthorized changes to security configuration.

Affected (2)

Products: Progress: Marklogic Server

1 product

Marklogic Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Progress Marklogic Server	Before 11.3.6
Progress Marklogic Server	From 12.0.0 to 12.0.3

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (1)

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026

Source: security@progress.com

Vendor Advisory

Timeline

No history available yet.