CVE-2026-7326: Progress Marklogic Server

High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthorized changes to security configuration.

Affected products

• Progress Marklogic Server: before 11.3.6 (fixed in 11.3.6); from 12.0.0, before 12.0.3 (fixed in 12.0.3)

Published 2026-08-05. Last modified 2026-09-03.