CVE-2026-85965

Executive Summary

CVE-2026-85965 is a high-severity (CVSS 8.0) memory-safety vulnerability classified as a use-after-free (CWE-416) affecting the JavaScript engine integration within Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7. An authenticated remote attacker with elevated privileges can trigger memory corruption, controlled process failure, or broader server instability. The vulnerability has no public proof-of-concept, no observed exploitation in the wild, and no CISA KEV listing, but due to the scope change (S:C) and high confidentiality/integrity/availability impacts, it represents a serious risk to unpatched MarkLogic deployments.

Technical Analysis

CVE-2026-85965 is a use-after-free defect (CWE-416) residing in the JavaScript engine integration of Progress MarkLogic Server. A use-after-free condition occurs when a program continues to reference memory after it has been freed, leading to undefined behavior that adversaries can potentially redirect toward arbitrary code execution or denial of service. In this case, the vulnerable component is the JavaScript execution subsystem — the layer that allows server-side JavaScript to execute within the MarkLogic environment.

The NVD description explicitly states the defect could result in "memory corruption, controlled process failure, or server instability." The term "controlled process failure" suggests the corruption is attacker-influenced rather than purely accidental, meaning an attacker may be able to deterministically crash or destabilize a targeted process rather than relying on random faulting. This is consistent with a use-after-free where the freed memory is re-referenced in a predictable code path.

The attack vector is network (AV:N), but complexity is high (AC:H) and privileges required are high (PR:H). This indicates that exploitation requires an authenticated session with elevated rights and that a degree of specialized knowledge or favorable runtime conditions is needed. The scope is changed (S:C), meaning a successful exploit could impact resources beyond the vulnerable component — for example, affecting the broader MarkLogic server process, host stability, or adjacent services within the same security authority. Confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H), implying that memory corruption could expose data, allow modification, or render the service unavailable.

The JavaScript engine integration is a known high-risk surface because it typically bridges a managed (scripting) runtime with native memory operations. However, no function names, class names, file paths, or API endpoints are provided in the NVD description or CNA title. Therefore, the precise trigger mechanism, affected JavaScript API, or call sequence cannot be determined from the available data. It is accurate to state that the flaw class is a use-after-free within that integration, and the observable outcome is memory corruption or controlled process failure. No further code-level detail should be inferred without vendor confirmation.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred strictly from the vulnerability class and the limited details in the NVD description. Specific function names, endpoints, and payload structures are not provided and must not be fabricated.

1. Reconnaissance / target identification: An adversary identifies internet- or internally exposed Progress MarkLogic Server instances. Fingerprinting focuses on MarkLogic-specific HTTP endpoints, administrative interfaces, or the JavaScript execution surface. Shodan dorks such as product:"MarkLogic" and http.title:"MarkLogic" can locate candidate hosts. The attacker must determine the version is 12.x (before 12.1.0) or 11.x (before 11.3.7).

2. Prerequisite access: Because the CVSS vector specifies PR:H, the attacker must first obtain authenticated, elevated access — for example, a compromised administrative or privileged application user account. This lowers the likelihood of opportunistic exploitation but does not reduce impact after a breach.

3. Triggering the use-after-free: Through the JavaScript engine integration, the attacker submits script or input that causes the engine to reference an object or memory buffer after it has been released. This is the essence of CWE-416. The high attack complexity (AC:H) implies the trigger may depend on timing, garbage-collection behavior, or specific runtime states. The result is memory corruption or a controlled process failure.

4. Post-exploitation impact: Depending on the exact layout and runtime, the corruption could lead to a crashed or destabilized MarkLogic process, denial of service across the affected node, potential exposure of in-memory data (C:H), modification of data or execution flow (I:H), and loss of availability (A:H). Scope change (S:C) means effects may extend beyond the immediate vulnerable component. There is no evidence of a weaponized payload or real-world campaign.

Practical exploitation is constrained by the lack of public exploit code, high complexity, and the privileged-access requirement. At this time, the vulnerability is best characterized as a serious post-authentication memory-safety risk rather than a remotely exploitable pre-auth flaw.

Impact Assessment

CVE-2026-85965 carries a CVSS v3.1 base score of 8.0 (High). Subscore breakdown:

• AV:N (Network) — exploitable across a network path without physical or adjacent-only access.
• AC:H (High) — exploitation depends on conditions not fully under attacker control, such as heap state or timing.
• PR:H (High) — requires privileged/authenticated access prior to exploitation.
• UI:N (None) — no user interaction required once prerequisites are met.
• S:C (Changed) — impact scope extends beyond the vulnerable JavaScript integration component.
• C:H / I:H / A:H — high confidentiality, integrity, and availability impact.

Business impact: MarkLogic Server is commonly deployed as an enterprise NoSQL database and data hub for mission-critical, regulated, or high-value data. A use-after-free in the JavaScript engine can lead to data exposure, integrity compromise, or sustained service instability. For organizations with privileged internal users or compromised credentials, the blast radius includes any data or workflow served by the affected MarkLogic cluster. Because the scope is changed, adjacent components or the underlying host may also be affected.

Blast radius: All MarkLogic 12.x deployments before 12.1.0 and 11.x deployments before 11.3.7 are affected. Environments that expose MarkLogic to internal networks or that permit privileged user scripting are at highest risk. The absence of KEV listing and public exploit code currently limits opportunistic mass exploitation, but targeted actors with existing privileged access could still abuse the flaw.

Affected systems: Enterprise search, content management, metadata repositories, and data-integration platforms built on MarkLogic 11.x/12.x.

Detection Guidance

Sigma Rule

title: Potential Progress MarkLogic Use-After-Free JavaScript Engine Exploitation
id: 9f1c2a74-3b6d-4e2f-8a10-7c5d1e9b4f20
status: experimental
description: Detects suspicious JavaScript engine activity or crash patterns consistent with CVE-2026-85965 memory corruption attempts on Progress MarkLogic Server.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85965
author: valtersit.com
date: 2026-01-01
logsource:
  product: marklogic
  category: application
detection:
  selection_crash:
    - EventID: 1000
      Application|contains: 'MarkLogic'
  selection_js:
    Message|contains:
      - 'JavaScript engine'
      - 'memory corruption'
      - 'use-after-free'
  condition: selection_crash or selection_js
fields:
  - Hostname
  - User
  - Message
falsepositives:
  - Legitimate application crashes unrelated to exploitation
  - Routine maintenance restarts
level: high

YARA Rule

rule CVE_2026_85965_MarkLogic_JS_MemoryCorruption
{
    meta:
        description = "Detects indicators of memory corruption or use-after-free related to CVE-2026-85965 in MarkLogic JavaScript engine logs"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85965"
        severity = "high"

    strings:
        $ml1 = "MarkLogic" ascii wide nocase
        $js1 = "JavaScript engine" ascii wide nocase
        $err1 = "use-after-free" ascii wide nocase
        $err2 = "memory corruption" ascii wide nocase
        $err3 = "SIGSEGV" ascii wide
        $err4 = "SIGABRT" ascii wide

    condition:
        $ml1 and 1 of ($js1, $err1, $err2) and 1 of ($err3, $err4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85965 Progress MarkLogic JavaScript Engine Memory Corruption Attempt"; flow:established,to_server; http.header; content:"MarkLogic"; http.uri; content:"/v1/"; pcre:"/(eval|javascript|js)/Ui"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-85965; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85965; sid:90085965; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5m
  [process where event.type == "start" and process.name : "MarkLogic*"]
  [process where event.type == "end" and process.name : "MarkLogic*" and process.exit_code != 0]

Splunk SPL Query

index=marklogic OR index=application (sourcetype=marklogic:* OR source="*marklogic*")
| search ("JavaScript engine" OR "use-after-free" OR "memory corruption" OR "SIGSEGV" OR "SIGABRT")
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, Message
| where count > 1
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85965,">
  <rule id="100965" level="12">
    <decoded_as>json</decoded_as>
    <field name="product">MarkLogic</field>
    <regex type="pcre2">(?i)(use-after-free|memory corruption|JavaScript engine|SIGSEGV|SIGABRT)</regex>
    <description>CVE-2026-85965: Potential MarkLogic JavaScript engine memory corruption detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is currently tracked, although the NVD description identifies version thresholds.

1. Immediate mitigations:

• Restrict network exposure of MarkLogic administrative and JavaScript-execution endpoints to trusted internal segments only; block direct internet access.
• Enforce least privilege for MarkLogic users; audit all accounts with elevated/scripting privileges and remove unnecessary rights, since PR:H is required to exploit.
• Monitor for process crashes or abnormal restarts, particularly those referencing the JavaScript engine or memory faults, as these may indicate exploitation attempts.
• Consider temporarily disabling or limiting untrusted server-side JavaScript execution where operationally feasible, as the vulnerability resides in that integration.

2. Patch / upgrade steps:

• While no vendor patch is confirmed in tracked sources, the NVD description indicates the defect is resolved in MarkLogic Server 12.1.0 and 11.3.7. Plan to upgrade to those versions or later.
• Confirm the exact fixed release through Progress's official MarkLogic advisory and support channels before deployment.
• Stage upgrades in non-production environments first, back up configurations and data, and validate application compatibility.

3. Long-term hardening:

• Maintain a rigorous patch-management cadence for MarkLogic Server and its JavaScript integration components.
• Isolate database nodes with network segmentation and zero-trust access controls.
• Enable comprehensive logging and forward logs to a SIEM with the detection rules above.
• Periodically review privileged accounts and integrate credential hygiene to reduce the post-authentication risk that enables this class of exploit.

References

• NVD — CVE-2026-85965: https://nvd.nist.gov/vuln/detail/CVE-2026-85965
• Progress MarkLogic Server — official product security advisories (consult for the authoritative fix confirmation and affected version matrix)
• MITRE CWE-416 — Use After Free: https://cwe.mitre.org/data/definitions/416.html
• FIRST EPSS — not yet scored for this CVE (no EPSS value available at time of writing)
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-85965 not listed; no known exploit-in-the-wild evidence or threat actor campaign associated at this time.