MarkLogic Server EUVD-2026-97563

Exploitation requires valid authenticated access to MarkLogic Server (CVSS PR:L confirms low-privilege credentials are needed - this is NOT an unauthenticated flaw) plus network reachability to the server's query interface. The attacker must submit crafted input to the affected 'certain query-processing functionality' (the specific feature is not named in the advisory). Limiting factors: authentication is mandatory, so purely external unauthenticated attackers cannot exploit it directly; only MarkLogic Server 12.x releases before 12.1.0 are affected, so environments on 12.1.0+ or earlier major branches are out of scope. No user interaction is required (UI:N).

CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H - network-reachable, low attack complexity, but requiring low-level authentication (PR:L) and no user interaction. The dominant impact is availability (A:H, server instability) with only limited confidentiality exposure (C:L, memory disclosure) and no integrity impact, which is consistent with a CWE-125 out-of-bounds read rather than a code-execution flaw. No EPSS score, SSVC decision data, KEV listing, or POC was provided in the input, so exploitation-likelihood signals are entirely absent - there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a legitimately prioritizable issue for MarkLogic operators because it is network-facing and low-complexity, but the mandatory authentication requirement (PR:L) and the limited, non-code-execution impact place it below a drop-everything emergency; it is best treated as a standard high-priority patch for exposed/multi-tenant deployments. Note the signal gap: with no EPSS/KEV/POC data supplied, real-world exploitation probability cannot be quantified from the input and should be revisited if Progress or CISA publishes further intelligence.

An attacker who already holds valid but low-privilege MarkLogic credentials (e.g., a limited application or tenant account) submits a specially crafted query that triggers the out-of-bounds read in the query-processing engine. This either crashes or destabilizes the server (denial of service) or returns fragments of adjacent process memory, potentially leaking limited sensitive data. No public exploit code is known at time of analysis, and the network attack vector with low complexity makes exploitation straightforward once authentication is obtained.