EUVD-2026-97557
GHSA-9mf9-3w9j-j23g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with high-privilege MarkLogic account
-
DeliverySubmit crafted server-side JavaScript
-
ExploitTrigger use-after-free in JS engine
-
ExecutionCorrupt engine process memory
-
ImpactCrash or destabilize server process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker who can execute server-side JavaScript on the MarkLogic Server JavaScript engine AND holds high privileges (CVSS PR:H) - i.e., an authenticated, already-privileged account rather than an anonymous remote user. The flaw is further limited by high attack complexity (AC:H), implying the use-after-free depends on specific timing or state conditions that are not reliably met on demand. Affected deployments are MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7; patched releases (12.1.0 / 11.3.7) and non-JavaScript-dependent configurations are not exposed. The practical gating factor for defenders is the combination of privileged authentication plus the ability to run server-side JavaScript, which confines realistic abuse to trusted/insider or post-compromise contexts. |
| Impact | This is a high-CVSS (8.0) but comparatively constrained-risk issue when all signals are weighed together. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) is network-reachable but gated by two significant barriers: high attack complexity (AC:H) and high privileges required (PR:H), meaning an attacker must already hold a privileged, authenticated foothold capable of executing server-side JavaScript and must win non-trivial conditions to trigger the use-after-free. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of high privilege requirement plus high complexity makes mass, opportunistic exploitation unlikely; realistic risk is primarily insider or post-compromise escalation/instability rather than external unauthenticated attack. Note a consistency point for verification: the description emphasizes 'memory corruption, controlled process failure, or server instability' (an availability-leaning outcome), yet the vendor vector asserts full C:H/I:H/A:H - the confidentiality/integrity impact appears inferred from the memory-corruption potential rather than demonstrated, so defenders should treat RCE/data-exposure as plausible-but-unconfirmed and availability/crash as the clearly supported impact. |
| Exploit ScenarioDerived | A user who already holds high-privilege access to a MarkLogic Server instance submits specially crafted server-side JavaScript designed to trigger a use-after-free in the JavaScript engine integration. Successfully meeting the timing/condition requirements corrupts process memory, crashing or destabilizing the server and potentially enabling further memory-corruption-based compromise. No public exploit code exists, and the high attack complexity means reliable triggering is non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Memory corruption through a use-after-free (CWE-416) in the JavaScript engine integration of Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 can lead to controlled process failure, server instability, or corrupted memory state. Exploitation is not anonymous: the assessed vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) requires a high-privileged account that can already execute server-side JavaScript, and the high attack complexity indicates the defect depends on specific timing or state conditions that are not reliably achievable on demand - so realistic abuse is confined to trusted, insider, or post-compromise contexts. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released fixed versions 12.1.0 (12.x track) and 11.3.7 (11.x track).
RemediationAI
Apply the vendor-released patch: upgrade MarkLogic Server 12.x installations to 12.1.0 or later, and 11.x installations to 11.3.7 or later, per the Progress advisory at https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026. If immediate upgrade is not possible, the effective compensating controls follow from the exploitation prerequisites: remove or tightly audit role grants that allow non-essential accounts to execute or deploy server-side JavaScript modules (trade-off: may break legitimate JavaScript-based applications and ETL/integration jobs, so scope grants to a small, named set of service accounts first); review which HTTP app servers expose JavaScript-capable endpoints and restrict them by network ACL or reverse-proxy allowlists to trusted administrative subnets (trade-off: clients outside those ranges lose access); and monitor and tightly limit highly privileged MarkLogic accounts, since a compromised privileged principal is the entry condition (trade-off: cannot be fully mitigated by access control alone). Operational hardening such as aggressive process health monitoring and scheduled restart windows may reduce the impact of process-instability outcomes but does not remediate the underlying use-after-free, and because AC:H limits reliability rather than blocking the flaw, complexity alone should not be treated as a mitigation. No public exploit code was identified at time of analysis, so prioritization should weight the privileged-access prerequisite ahead of mass-exploitation likelihood.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-416, Use After Free, occurring in the integration layer that exposes server-side JavaScript execution inside MarkLogic Server; the accompanying tags also flag buffer overflow and general memory-corruption behavior, consistent with memory-safety defects that can be triggered when the JavaScript engine releases or reuses objects that are still referenced. Because JavaScript runs in-process alongside the database and HTTP/app server components, a memory-safety fault in that integration can propagate beyond a single query into process-level instability, denial of service, or potentially attacker-influenced memory state. The CVSS vector is notable for Scope:Changed (S:C) with High confidentiality, integrity, and availability impact, meaning the vulnerable JavaScript component can affect resources beyond its own security scope - but it is gated by PR:H (a privileged, authenticated principal) and AC:H (exploitation depends on non-deterministic timing/state), and the attack is network-reachable (AV:N) with no user interaction (UI:N). The affected product is identified by CPE cpe:2.3:a:progress_software_corporation:marklogic_server, and any deployment that does not expose or grant server-side JavaScript execution is materially less exposed.
Know when Marklogic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable JS execution but gated by privileged auth (PR:H) and timing-dependent use-after-free (AC:H); engine-to-process memory corruption justifies scope change and full impact.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
Lifecycle Timeline
2DescriptionCVE.org
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.
Executive ViewAI
Progress MarkLogic Server 11.x and 12.x contain a memory corruption flaw in the server-side JavaScript engine that can destabilize or crash database instances and corrupt memory state. Because exploitation requires an already highly privileged account capable of running server-side JavaScript, the practical risk is concentrated among trusted insiders, compromised administrative accounts, and post-breach scenarios rather than external attackers. Leadership should care because affected MarkLogic clusters underpin data-intensive business applications, and an unpatched, unstable instance threatens availability and data integrity for those dependent services.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Marklogic Server
View allAuthenticated XQuery injection in Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 allows a remote at
An authenticated privilege-escalation flaw in Progress MarkLogic Server lets an attacker who already holds forest-manage
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a l
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthentic
Insufficient isolation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows code executed throu
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote at
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote attacker to perform privileged admi
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged u
Exploit-DB