Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of data.
Published: 2026-10-12
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Server instability or limited data modification
Action: Immediate Patch
AI Analysis

Impact

This vulnerability is an out‑of‑bounds write (CWE-787) in language‑processing functions of Progress MarkLogic Server. A remote authenticated attacker can trigger the write to destabilize the server or modify data, potentially leading to denial of service or subtle corruption of stored information.

Affected Systems

Progress Software Corporation MarkLogic Server, versions 12.x prior to 12.1.0 and 11.x prior to 11.3.7.

Risk and Exploitability

The vulnerability has a CVSS score of 7.1, indicating high severity. An EPSS score is not available, so exploitation likelihood is uncertain, but the risk remains significant. It is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. The attack vector is a remote authenticated attacker, meaning the attacker must obtain valid user credentials to exploit the flaw over the network.

Generated by OpenCVE AI on October 12, 2026 at 17:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a patched release of MarkLogic Server (12.1.0 or later or 11.3.7 or later) that resolves the out‑of‑bounds write (CWE-787).
  • If an upgrade cannot be performed immediately, restrict network access to the language‑processing services and enforce least‑privilege account usage for administration.
  • Continuously monitor server stability and audit data integrity for signs of abnormal behavior or unauthorized modifications.

Generated by OpenCVE AI on October 12, 2026 at 17:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Progress Software Corporation
Progress Software Corporation marklogic Server
Vendors & Products Progress Software Corporation
Progress Software Corporation marklogic Server

Mon, 12 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of data.
Title Out-of-bounds write in Progress MarkLogic Server
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

Progress Software Corporation Marklogic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-10-15T19:14:59.110Z

Reserved: 2026-09-04T18:43:16.554Z

Link: CVE-2026-85969

cve-icon Vulnrichment

Updated: 2026-10-15T19:11:57.172Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-12T17:17:37.500

Modified: 2026-10-15T20:17:15.673

Link: CVE-2026-85969

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T18:00:03Z

Weaknesses