The vulnerability allows an attacker to inject and execute arbitrary user‑supplied code through specific REST and XDBC evaluation paths in earlier releases of Progress MarkLogic Server. This insufficient isolation can lead to unauthorized actions or compromise of an authenticated session, effectively enabling remote code execution. The weakness is classified as CWE-346: Access to a Resource with Elevated Privileges.

Affected products are Progress Software Corporation’s MarkLogic Server. Versions prior to 12.1.0 in the 12.x branch and prior to 11.3.7 in the 11.x branch suffer from this flaw.

The CVSS score of 9.6 marks it as critical. Although no EPSS score is available, the lack of exploitation data does not diminish the severity. The flaw is not yet listed in CISA KEV. The attacker would need to reach the affected REST or XDBC evaluation endpoints, which are typically exposed via HTTP, and supply malicious code, with the potential to gain full control of the server or hijack authenticated sessions. The high score and the ability to bypass isolation make it a high‑risk vulnerability.