Progress MarkLogic CVE-2026-85969

Exploitation requires an authenticated session with at least low-level privileges on MarkLogic Server (CVSS PR:L) and the ability to reach the affected language-processing functionality over the network; it is not exploitable by an anonymous/unauthenticated remote attacker. Only MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 are affected, so patched or older-branch-fixed instances are out of scope. The primary limiting factor is the mandatory pre-existing authentication, which constrains the realistic threat to insiders or attackers who have already obtained credentials or compromised an application account; the vendor does not state a non-default configuration requirement, so default deployments running the affected language-processing feature appear exposed to authenticated users.

This is a genuine but mid-tier priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, base 7.1) shows a network-reachable, low-complexity flaw with no user interaction, but it explicitly requires PR:L - the attacker must already hold valid authenticated low-privilege credentials on the MarkLogic Server. Impact is skewed toward availability (A:H, server instability / crash) with only limited integrity impact (I:L) and no confidentiality loss (C:N), which is consistent with an out-of-bounds write (CWE-787) that corrupts memory but does not clearly yield full code execution or data disclosure. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable near-term exploitation; the realistic threat is an authenticated insider or an attacker who has already compromised an application/service account abusing crafted language-processing input. Signals are internally consistent (no contradiction between the network vector and the description), but the absence of EPSS/KEV/POC data means exploitation likelihood is genuinely unknown rather than confirmed low.

An attacker possessing valid low-privilege MarkLogic credentials (or control of a compromised application service account) submits specially crafted input to the affected language-processing functionality over the network, triggering an out-of-bounds write. The memory corruption destabilizes or crashes the server (availability impact) and may allow limited unauthorized modification of data. No public exploit code was identified at time of analysis, and because PR:L is required, exploitation is gated behind prior authentication.