CVE-2026-7326 is a cross-site request forgery flaw in the Admin UI of Progress MarkLogic Server. A remote attacker who lures a signed in administrator to a hostile page can make changes on the administrator's behalf. The record scores it 7.5, High. The fixed releases are 11.3.6 and 12.0.3.
What's affected
The record says Progress MarkLogic Server before 11.3.6 and before 12.0.3 is affected, so the fixed releases are 11.3.6 on the 11.x line and 12.0.3 on the 12.x line. The record cites a Progress community article titled as a critical security alert bulletin for August 2026. That page needs a browser to render, so we could not read its text. The affected range comes from the record alone. Check the bulletin for the full list of fixed builds, any earlier lines, and vendor guidance.
The record describes the exposure as follows. The attacker lures an authenticated administrator to a malicious web page. The page then performs administrative actions through the Admin UI, with the administrator's session. The record says this can lead to unauthorized changes to security configuration. The attack complexity is rated high and needs user interaction.
The weakness class is CWE-352, cross-site request forgery.
How to check if you're exposed
Find the version of every MarkLogic server you run. In Query Console you can run a one line query.
xdmp:version()
If you manage MarkLogic with scripts, read the version from the package or image tag you deploy. A result below 11.3.6 on the 11.x line, or below 12.0.3 on the 12.x line, matches the affected range in the record.
Then think about the human side. The risk depends on who uses the Admin UI and from which browser. An administrator who browses the web in the same browser session where they are signed in to the Admin UI is the person this attack needs. The free in-browser scan at gold.safeguard.sh/scan accepts a manifest and lists known CVEs for the packages it finds.
What to do now
- Upgrade MarkLogic Server to 11.3.6 or 12.0.3, or later, depending on your line.
- Read the Progress security bulletin for August 2026 and follow its steps, since we could not read it.
- Ask administrators to sign out of the Admin UI when they are done, and not to browse other sites in the same session.
- Use a dedicated browser profile for administration.
- Restrict network access to the Admin UI to a management network or VPN.
- Review recent security configuration changes for anything you did not make.
Why it matters
Cross-site request forgery works because a browser attaches a session to every request to a site, even one started from another page. If the server does not check that the request really came from its own interface, a hostile page can submit forms for the signed in user. The defence is a per-request token that an outside page cannot know.
On rating, the record scores this 7.5 High under CVSS 3.1. The vendor article is titled as a critical alert bulletin, judging by its address. We could not read the page, so we cannot say what rating or reasoning the vendor gives. Where the vendor and the record differ, follow the vendor's guidance on urgency. The impact described, changes to security configuration, is serious in a database that stores sensitive data. No source we read says it has been exploited in the wild, and the CVE is not on the CISA KEV list.
Quick check
What does an attacker need?
To lure a signed in MarkLogic administrator to a malicious page, per the record. It needs user interaction.
Which versions fix it?
11.3.6 on the 11.x line and 12.0.3 on the 12.x line, according to the record.
Sources
Last reviewed: 18 October 2026.
