CVE-2026-7326

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthorized changes to security configuration.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Progress Software Corporation	MarkLogic Server	>= 11.0.0, < 11.3.6; >= 12.0.0, < 12.0.3

References

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026Vendor Advisory

Timeline

Published: Aug 5, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-732607.5Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails CVE-2026-732617.5Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_built CVE-2026-732625.4Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.CVE-2026-732639.9Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a lega CVE-2026-732647.6Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an u CVE-2026-732656.5RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, an CVE-2026-732667.1A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerabil CVE-2026-732677.7A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and de CVE-2026-732689.9A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on Clu CVE-2026-732699.9A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming con CVE-2026-73278.1An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 1 CVE-2026-732708.2Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside