CVE-2026-9191

{
  "etk_id": "ETK-2026-1405",
  "cve_id": "CVE-2026-9191",
  "display_id": "CVE-2026-9191",
  "ghsa_id": "GHSA-gr4w-j394-9q4x",
  "euvd_id": "EUVD-2026-97504",
  "status": "published",
  "anchor_state": "anchored",
  "title": "User-code isolation flaw in MarkLogic Server",
  "summary": "MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 inadequately separates user-executed code from HTTP and session state in certain REST and XDBC evaluation paths. An attacker who can execute code through one of those paths may perform actions without authorization or take over an authenticated session.",
  "mitigation": "Upgrade MarkLogic Server 12.x to 12.1.0 or later, or 11.x to 11.3.7 or later. Restrict access to REST and XDBC code-evaluation paths until upgrades are complete.",
  "vendor": "Progress Software Corporation",
  "product": "MarkLogic Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 11.0.0, < 11.3.7",
        ">= 12.0.0, < 12.1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "11.3.7",
        "12.1.0"
      ],
      "package_name": "MarkLogic Server",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
  "epss_score": 0.0021,
  "epss_percentile": 0.1023,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 39.26903361666667,
  "t0_at": "2026-10-12T15:32:46.475000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T15:32:46.475000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T15:32:46.475000+00:00",
      "url": "https://github.com/advisories/GHSA-gr4w-j394-9q4x"
    }
  }
}