high7.5
CVE-2026-85960
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console.
Impact
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's permissions.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Progress | Progress MarkLogic Server 12.X Releases | before 12.1.0 |
| 11.X Releases | before 11.3.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.