Cross-site scripting in MarkLogic - CVE-2026-9195
Published: August 6, 2026
Vulnerability identifier: #VU141066
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-9195
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript in an authenticated administrator's browser session.
The vulnerability exists due to cross-site scripting in the MarkLogic Query Console when an authenticated administrator visits a crafted URL. A remote attacker can lure an authenticated administrator to a crafted URL to execute arbitrary JavaScript in an authenticated administrator's browser session.
This may allow credential capture and privileged actions to be performed on the administrator's behalf.
Affected software
MarkLogic
How to mitigate CVE-2026-9195
Install security update from vendor's website.
MarkLogic - addressed in versions 11.3.6, 12.0.3