CVE-2026-85960 [HIGH] – Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim’s permissions.