MarkLogic Server CVE-2026-85976

Exploitation requires an authenticated session to the MarkLogic Query Console (PR:L) and targets its file-exploration endpoint, which fails to sufficiently sanitize input, permitting CR/LF injection into the HTTP response. A second limiting factor is required user interaction (UI:R): a victim must trigger the attacker-influenced request, so this is not a fully automated remote attack. Only affected versions are vulnerable - MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7; patched releases 12.1.0 and 11.3.7 remediate it. Impact is confined to client-side response handling (scope-changed, low confidentiality and integrity, no availability impact) rather than direct server compromise.

This is a moderate-severity, authenticated client-side injection issue rather than a high-priority server compromise. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) shows network reachability and low attack complexity, but two significant limiters: it requires an authenticated user (PR:L) and victim user interaction (UI:R), with only low confidentiality and integrity impact and no availability impact. The scope change (S:C) reflects that the injected HTTP response affects a downstream component - the client/browser - rather than the MarkLogic server itself, which is consistent with CWE-113 HTTP response splitting. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation probability signals are simply absent, not low-confirmed. Note the input tags label this 'Information Disclosure', which only partially matches CWE-113 (response splitting is primarily a response-manipulation/injection class that can enable cache poisoning, XSS, or session-related effects, not pure disclosure) - treat the tag as approximate. Overall this is a real but lower-tier issue: patch in normal cycles, not an emergency, given the authentication and user-interaction prerequisites.

An authenticated MarkLogic user with access to the Query Console crafts input to the file-exploration endpoint containing CR/LF sequences, then lures another authenticated user into triggering the request (e.g., via a crafted link). The injected headers split the HTTP response, allowing manipulation of how the victim's browser handles the response (e.g., content spoofing or cache poisoning). No public exploit code was identified at time of analysis.