Issues   

• CVE-2026-7326 — CWE-352: Cross-Site Request Forgery (CSRF) 
  In Progress MarkLogic Server before 11.3.6 and before 12.0.3, a remote attacker who lures a currently authenticated administrator to a malicious page can cause administrative actions to be performed on the administrator's behalf without their knowledge, which may result in unauthorized changes to security configuration.  

• CVE-2026-7327 — CWE-269: Improper Privilege Management 
  In Progress MarkLogic Server before 11.3.6 and before 12.0.3, an authenticated user holding an administrative REST role can escalate privileges through a flaw in the REST API document processing pipeline, which may result in unauthorized disclosure of sensitive server-side data when accessed by a higher-privileged user.  

• CVE-2026-7329 — CWE-269: Improper Privilege Management 
  In Progress MarkLogic Server before 11.3.6 and before 12.0.3, an authenticated user holding only a low-privileged REST role can escalate privileges to administrator through a flaw in a REST query endpoint, enabling execution of privileged operations and unauthorized data access.  

• CVE-2026-7557 — CWE-347: Improper Verification of Cryptographic Signature 
  In Progress MarkLogic Server before 11.3.6 and before 12.0.3, the SAML authentication module does not correctly verify the cryptographic signature of a SAML response, allowing an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators.  

• CVE-2026-8709 — CWE-269: Improper Privilege Management 
  In Progress MarkLogic Server before 11.3.6 and before 12.0.3, an authenticated user holding only a low-privileged REST role can escalate privileges through a flaw in the REST document patch operation, enabling execution of privileged operations against the Security database.   

• CVE-2026-9190 — CWE-444: Inconsistent Interpretation of HTTP Requests  
  In Progress MarkLogic Server before 11.3.6 and before 12.0.3, a flaw in how the MarkLogic HTTP App Server parses HTTP requests allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials.   

• CVE-2026-9192 — CWE-287: Improper Authentication 
  In Progress MarkLogic Server before 11.3.6 and before 12.0.3, an unauthenticated remote attacker can bypass password verification on a MarkLogic ODBC App Server and execute queries with the privileges of any named user known to the server, including administrators.   

• CVE-2026-9193 — CWE-269: Improper Privilege Management 
  In Progress MarkLogic Server before 11.3.6 and before 12.0.3, an authenticated user holding only a low-privileged Hadoop role can escalate privileges through a flaw in the MarkLogic Hadoop integration, enabling execution of privileged operations against the Security database.   

• CVE-2026-9195 — CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 
  In Progress MarkLogic Server before 11.3.6 and before 12.0.3, a flaw in the MarkLogic Query Console allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.   

• CVE-2026-9203 — CWE-918: Server-Side Request Forgery (SSRF) 
  In Progress MarkLogic Server before 11.3.6 and before 12.0.3, an authenticated user holding only low-privileged roles can bypass MarkLogic's protections against requests to cloud instance metadata endpoints, resulting in disclosure of cloud credentials and onward compromise of cloud resources accessible to the host instance.