CVE-2026-9191

Name of the Vulnerable Software and Affected Versions MarkLogic Server versions 11.0.0 through 11.3.6 MarkLogic Server versions 12.0.0 through 12.0.x

Description Insufficient isolation of user-supplied code executed through certain REST and XDBC evaluation paths may expose HTTP request, response, and session state. An attacker capable of executing code through these affected paths could perform unauthorized actions or compromise an authenticated session.

Recommendations Upgrade MarkLogic Server versions 11.0.0 through 11.3.6 to 11.3.7 or later. Upgrade MarkLogic Server versions 12.0.0 through 12.0.x to 12.1.0 or later. Restrict untrusted code evaluation and review session-access controls.