CVE-2026-7326

Summary

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthorized changes to security configuration.

Affected Software

VendorProductVersion RangeStatus
Progress Software CorporationMarkLogic Server11.0.0 < 11.3.6affected
Progress Software CorporationMarkLogic Server12.0.0 < 12.0.3affected

Weaknesses

  • CWE-352: CWE-352: Cross-Site Request Forgery (CSRF)

Workarounds

Restrict network access to the Admin UI to trusted internal networks. Use a reverse proxy to reject cross-origin requests to administrative endpoints. Administrators should avoid opening untrusted links while authenticated to the Admin UI and use a separate browser profile for administrative work.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References