#NØØT_Security_Alerts 🚨 #ALERT — CRITICAL MARKLOGIC CODE-ISOLATION FLAW THREATENS AUTHENTICATED SESSIONS October 12, 2026 DISCLOSED BY: Progress Software Corporation PRODUCT: MarkLogic Server CVE: CVE-2026-9191 SEVERITY: CRITICAL — CVSS 9.6 AFFECTED VERSIONS: MarkLogic Server 11.0.0–11.3.6. MarkLogic Server 12.0.0 through versions before 12.1.0. IMPACT: Insufficient isolation of user-supplied code executed through certain REST and XDBC evaluation paths may expose HTTP request, response and session state. An attacker able to execute code through an affected evaluation path could perform unauthorized operations or compromise an authenticated session. EXPOSURE: Requires an application path capable of executing attacker-influenced code. The vendor’s CVSS assessment specifies network access and required user interaction, without attacker privileges. The exact exploitable application configurations are not fully detailed in the public CVE record. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL SECURITY VULNERABILITY. No confirmed malicious in-the-wild exploitation or independently verified public working PoC. Forensic triage: Investigate unexpected REST/XDBC evaluation activity, anomalous session behavior, unauthorized application operations and suspicious access to protected data. No confirmed malicious IOCs published. URGENT ACTION: Upgrade MarkLogic 11.x to 11.3.7 or later and 12.x to 12.1.0 or later. Restrict untrusted code evaluation, review session-access controls and investigate unexplained authenticated actions. SOURCE: https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026 OFFICIAL CVE: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9191.json CONFIDENCE: HIGH — Progress-authored CVE record confirms the isolation weakness, affected versions and potential session compromise. Actual malicious exploitation remains unverified. #CyberSecurity #ThreatIntel #MarkLogic #SessionSecurity #DatabaseSecurity #AppSec