CVE-2026-85960

Executive Summary

CVE-2026-85960 is a cross-site request forgery (CSRF) vulnerability in Progress MarkLogic Server affecting 12.x releases before 12.1.0 and 11.x releases before 11.3.7. The Query Console component uses predictable CSRF tokens, allowing a remote attacker who lures an authenticated Query Console user to a malicious page to submit unauthorized requests and execute server-side code with the victim's permissions. With a CVSS base score of 7.5, successful exploitation yields high confidentiality, integrity, and availability impact on the affected server, though the attack requires user interaction.

Technical Analysis

The vulnerability resides in the Query Console of Progress MarkLogic Server. Query Console is an administrative web interface that allows authenticated users to run queries — including server-side code — against the MarkLogic database. To protect state-changing operations from cross-site request forgery, the application is expected to issue unpredictable, per-session anti-CSRF tokens and validate them on every request.

CVE-2026-85960 is classified as CWE-352 (Cross-Site Request Forgery). Per the NVD description, the Query Console "use[s] predictable CSRF tokens." Predictable token generation defeats the core security property that CSRF defenses rely on: an attacker must not be able to guess or derive the token value. When tokens are predictable, an attacker can forge a valid request that the server accepts as legitimate because the token matches the expected pattern.

The attack surface is the Query Console web interface reachable over the network (AV:N). The CVSS vector (AC:H, PR:N, UI:R) reflects that exploitation requires the attacker to overcome the predictability condition and to induce an authenticated victim to trigger the crafted request (user interaction required), while no prior privileges are needed on the attacker's side. The scope is unchanged (S:U), and the impact on confidentiality, integrity, and availability is each rated High, consistent with the description's statement that unauthorized requests can lead to execution of server-side code with the victim's permissions.

No further technical detail — such as the specific token generation algorithm, the exact request parameters, or the affected endpoint paths — is available in the provided NVD description or CNA title. The precise implementation weakness (for example, whether tokens are time-based, sequential, or derived from a low-entropy seed) is not documented in the source data and is not asserted here.

Exploitation Scenarios

The following chain is inferred from the vulnerability class (CSRF via predictable tokens) and the NVD description. No public proof-of-concept exists; the attack chain below is described at the vulnerability-class level.

1. Reconnaissance / target identification: The attacker identifies an internet- or intranet-reachable MarkLogic Server running a vulnerable release (12.x before 12.1.0 or 11.x before 11.3.7) with Query Console enabled. Because the CSRF tokens are predictable, the attacker studies the pattern of tokens issued to the Query Console to determine how to forge a token that the server will accept.

2. Triggering the flaw class: The attacker constructs a malicious web page containing a request directed at the victim's Query Console. The request carries a forged CSRF token that matches the predictable pattern the server expects. The attacker then lures an authenticated Query Console user to visit the malicious page.

3. Payload / execution method: When the victim's browser loads the malicious page, it automatically issues the crafted request to the Query Console, authenticated by the victim's existing session cookie. Because the forged token is accepted, the server processes the request as coming from the legitimate user. The request can be crafted to perform unauthorized actions, including submitting queries that execute server-side code with the victim's permissions.

4. Post-exploitation impact: Server-side code execution in the victim's security context can allow the attacker to read or modify data accessible to the victim's role, alter database content, or disrupt availability. The CVSS impact ratings (C:H/I:H/A:H) reflect this broad impact. The scope remains unchanged, so the primary blast radius is the MarkLogic Server and the data and privileges available to the compromised authenticated user.

Impact Assessment

CVE-2026-85960 carries a CVSS 3.1 base score of 7.5 (High). The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H indicates:

• Attack Vector (Network): the Query Console is reachable over the network.
• Attack Complexity (High): exploitation depends on conditions such as the predictability of tokens and the attacker's ability to craft a matching value and deliver it to an authenticated user.
• Privileges Required (None): the attacker does not need an account on the target.
• User Interaction (Required): an authenticated Query Console user must be lured to the malicious page.
• Scope (Unchanged): impact is confined to the vulnerable component's security authority.
• Confidentiality / Integrity / Availability: all High.

Business impact includes unauthorized server-side code execution with the victim's permissions, which can lead to data exposure, data tampering, and service disruption within the MarkLogic deployment. Because Query Console is an administrative interface, the privileges available to the victim session may be significant, widening the potential blast radius to any data and configuration the victim role can reach. The requirement for user interaction and the High attack complexity reduce the likelihood of fully automated mass exploitation, but a targeted phishing lure against an administrator substantially raises the severity of a successful attack.

Detection Guidance

Sigma Rule

title: Potential MarkLogic Query Console CSRF Exploitation Attempt
id: 3f9c1a72-5b64-4e0d-9a2f-8c1d4b7e0a11
status: experimental
description: Detects access to MarkLogic Query Console with cross-site referer
  patterns indicative of a CSRF lure page targeting predictable token flaw.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85960
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: marklogic
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/qconsole'
  selection_method:
    cs-method: 'POST'
  selection_referer:
    cs-referer|contains:
      - 'http'
  filter_referer_self:
    cs-referer|contains: 'qconsole'
  condition: selection_uri and selection_method and selection_referer and not filter_referer_self
falsepositives:
  - Legitimate integrations submitting Query Console requests from external referers
level: medium

YARA Rule

rule CVE_2026_85960_MarkLogic_CSRF_Lure
{
    meta:
        description = "Detects HTML lure pages referencing MarkLogic Query Console with form auto-submit patterns consistent with CSRF exploitation of predictable tokens"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85960"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ml1 = "qconsole" ascii nocase
        $ml2 = "MarkLogic" ascii nocase
        $form1 = "<form" ascii nocase
        $submit1 = "submit()" ascii nocase
        $submit2 = "onload" ascii nocase
        $csrf = "csrf" ascii nocase
        $token = "token" ascii nocase

    condition:
        uint16(0) == 0x3C21 or uint16(0) == 0x6874
        and filesize < 512KB
        and any of ($ml1, $ml2)
        and $form1
        and any of ($submit1, $submit2)
        and any of ($csrf, $token)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85960 MarkLogic Query Console CSRF Attempt (cross-site POST to qconsole)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"qconsole"; nocase; http.referer; content:"http"; nocase; http.referer; content:!"qconsole"; nocase; classtype:web-application-attack; reference:cve,2026-85960; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85960; sid:2026859601; rev:1;)

Elastic Detection

query: |
  network where
    http.request.method == "POST" and
    stringContains(http.request.uri, "qconsole") and
    http.request.referrer != null and
    stringContains(http.request.referrer, "http") and
    not stringContains(http.request.referrer, "qconsole")

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=marklogic
| eval uri=coalesce(uri, cs_uri_stem), method=coalesce(method, cs_method), referer=coalesce(referer, cs_referer)
| where like(uri, "%qconsole%") AND method="POST"
| where like(referer, "http%") AND NOT like(referer, "%qconsole%")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, referer
| sort - count

Wazuh OSSEC Rule

<group name="web,marklogic,cve-2026-85960">
  <rule id="2026601" level="10">
    <if_sid>31100</if_sid>
    <id>^POST$</id>
    <url>qconsole</url>
    <description>CVE-2026-85960: Possible MarkLogic Query Console CSRF exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85960,</group>
  </rule>
  <rule id="2026602" level="12">
    <if_sid>2026601</if_sid>
    <referer>^http</referer>
    <description>CVE-2026-85960: Cross-site referer to MarkLogic Query Console - likely CSRF lure</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85960,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to Query Console to trusted administrative networks only; do not expose it to untrusted or internet-origin traffic.
   • Enforce strict CSRF protections at the reverse proxy or WAF layer, such as validating Origin/Referer headers on state-changing requests to Query Console and blocking cross-site POSTs.
   • Require administrative users to log out of Query Console when not in use, and avoid browsing untrusted sites in the same browser profile while authenticated.
   • Apply Content-Security-Policy and SameSite cookie attributes at the proxy layer to reduce the feasibility of cross-site request forgery.

2. Patch/upgrade steps:

   • The NVD description indicates the affected ranges are 12.x before 12.1.0 and 11.x before 11.3.7. Upgrade to 12.1.0 (or later 12.x) or 11.3.7 (or later 11.x) as applicable.
   • No vendor advisory or patch reference is currently confirmed in tracked sources. Verify the current fixed release directly with Progress MarkLogic support and the official release notes before upgrading, and retest the Query Console CSRF behavior after applying updates.

3. Long-term hardening:

   • Adopt a vulnerability management process that tracks MarkLogic releases and applies security updates promptly.
   • Monitor and alert on anomalous cross-site requests to Query Console using the detection content above.
   • Reduce reliance on Query Console for routine operations where possible, and enforce least privilege on accounts that can access it.

References

• NVD — CVE-2026-85960: https://nvd.nist.gov/vuln/detail/CVE-2026-85960
• MITRE CWE-352 (Cross-Site Request Forgery): https://cwe.mitre.org/data/definitions/352.html
• Progress MarkLogic Server product documentation and release notes: https://www.progress.com/marklogic
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85960 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• OWASP Cross-Site Request Forgery Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html

No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild exploitation or threat actor campaigns was identified in the available data for CVE-2026-85960.