CVE-2026-85968

Executive Summary

CVE-2026-85968 is an out-of-bounds read (CWE-125) in Progress MarkLogic Server 12.x releases prior to 12.1.0, located in query-processing functionality. A remote, authenticated attacker can trigger the flaw to cause server instability (availability impact) and potentially disclose limited information from process memory (confidentiality impact). The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H), and no public proof-of-concept, exploit code, or Nuclei template is currently available.

Technical Analysis

The vulnerability is classified under CWE-125, "Out-of-Bounds Read." Per the NVD description, the defect resides in "certain query-processing functionality" of MarkLogic Server 12.x releases before 12.1.0. An out-of-bounds read occurs when software reads data past the end (or before the beginning) of an allocated memory buffer. The direct consequences of this class of flaw are twofold:

1. Availability impact (rated High): Reading beyond a buffer boundary can lead to unmapped-memory accesses that crash the process or destabilize the service, producing denial-of-service conditions. The CVSS vector reflects this with A:H.
2. Confidentiality impact (rated Low): When the out-of-bounds region contains process memory that is subsequently returned or exposed to the requester, limited information disclosure can result. The CVSS vector reflects a constrained leak with C:L.

The attack vector is network-based (AV:N), requires low attack complexity (AC:L), and — critically — requires authentication (PR:L). No user interaction is required (UI:N), and the vulnerable component is treated as a single security scope (S:U).

Note on specificity: The NVD description does not identify a specific function, class, module, query language construct, API endpoint, or parameter associated with the defect. No implementation-level detail (e.g., parser function names, buffer sizes, or request syntax) is available from the provided data. Accordingly, this report describes the vulnerability at the class level and does not fabricate code-level specifics. The precise trigger — which query-processing operation reads out of bounds and under what input conditions — is not disclosed in the source intelligence.

Affected product scope, per the description, is Progress MarkLogic Server 12.x, with 12.1.0 representing the version boundary after which the described 12.x releases are no longer in scope. The Affected Versions and OSV package fields in the source data are empty, so no further package-level version enumeration can be confirmed.

Exploitation Scenarios

Because no public PoC, exploit code, or Nuclei template exists, the attack chain below is inferred from the vulnerability class (CWE-125) and the CVSS attributes. It does not rely on any invented function names, endpoints, or parameters.

1. Reconnaissance / target identification. An adversary identifies an internet- or intranet-exposed MarkLogic Server instance in the 12.x range before 12.1.0. Because the flaw is network-reachable (AV:N), the attacker only needs network access to the query-processing interface. Discovery can be performed with Shodan-style product fingerprinting (e.g., product:"MarkLogic") or by identifying the service during internal scanning.

2. Authentication. The vulnerability requires an authenticated session (PR:L). The attacker must possess valid low-privilege credentials or otherwise obtain authenticated access to the query-processing interface. This prerequisite lowers the risk profile somewhat, since anonymous unauthenticated attackers cannot directly exploit it.

3. Triggering the flaw (vulnerability class level). With authenticated access, the attacker submits a crafted query that exercises the affected query-processing code path such that a buffer boundary is crossed during a read. The out-of-bounds read is the specific defect class; the exact input shaping that induces it is not documented in the available intelligence and must not be assumed. The attacker's objective at this stage is to drive the parser/processor into reading memory beyond the intended region.

4. Payload / execution method. No memory-corruption write is described — this is a read, not a write. Consequently, classic remote code execution is not indicated by the description. The "payload" is the malformed or boundary-stressing query input itself; the effect is either a crash/instability or a constrained memory disclosure depending on how the read result is handled by the application.

5. Post-exploitation impact. Out-of-bounds reads of this nature can yield unintended disclosure of process memory fragments — for example, residual data from prior queries or internal structures — which may assist further targeting or leak sensitive values. The more reliably demonstrable outcome, given the A:H rating, is denial-of-service: the process may crash or become unstable, degrading or taking down the server for legitimate users.

Impact Assessment

• Confidentiality (Low): Limited information from process memory may be disclosed. This is constrained rather than wholesale data exfiltration.
• Integrity (None): The CVSS vector specifies I:N; the flaw is a read, not a write, so data modification is not indicated.
• Availability (High): Server instability and potential crash/denial-of-service are the dominant concerns, reflected in A:H and driving the 7.1 base score.
• Attack prerequisites: Network reachability plus valid low-privilege authentication (PR:L). This means an insider, a compromised low-privileged account, or any actor holding valid credentials on a reachable endpoint can mount the attack without user interaction.

Business impact: MarkLogic Server is typically deployed as an enterprise data platform / operational data hub. Instability or crashes in its query-processing path can disrupt dependent applications, degrade SLAs, and interrupt analytics or transactional workloads. Even a "low" confidentiality leak can be material if the disclosed memory contains query fragments, identifiers, or other sensitive tokens. Organizations running affected 12.x versions should treat this as a priority remediation item given the confirmed availability impact and the absence of a tracked patch source for confirmation.

Blast radius: All deployments of MarkLogic Server 12.x prior to 12.1.0 that expose the query-processing interface to authenticated users are potentially in scope. No CISA KEV listing exists (KEV: NO), and no exploit-in-the-wild evidence is present in the source data, so current exposure is based on potential rather than confirmed active exploitation.

Detection Guidance

Detection should focus on anomalous query-processing activity from authenticated sessions: malformed or boundary-stressing queries, abnormal error/crash rates on the MarkLogic service, and unexpected process restarts. Because no public PoC defines exact input signatures, the detection rules below are necessarily behavioral and class-oriented; they must be tuned to the environment.

Sigma Rule

title: Potential MarkLogic Server CWE-125 Out-of-Bounds Read Exploitation Attempt
id: 8b1f0c2e-4a7d-4f9a-9c3e-2d6b7a1e5f00
status: experimental
description: Detects anomalous query-processing activity and service instability consistent with an out-of-bounds read (CVE-2026-85968) in Progress MarkLogic Server 12.x before 12.1.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85968
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  product: marklogic
  service: query
detection:
  selection_error:
    EventID:
      - 'query-error'
      - 'query-failure'
    Message|contains:
      - 'out of bounds'
      - 'segmentation'
      - 'access violation'
      - 'buffer'
  selection_crash:
    EventID:
      - 'process-crash'
      - 'service-restart'
      - 'uncaught-exception'
  timeframe: 5m
  condition: selection_error or selection_crash
falsepositives:
  - Legitimate malformed queries from development or testing
  - Routine service restarts during maintenance windows
level: medium
tags:
  - attack.t1190
  - cve.2026-85968
  - cwe.125

YARA Rule

rule CVE_2026_85968_MarkLogic_OOB_Read_Indicator
{
    meta:
        description = "Detects references to CVE-2026-85968 or MarkLogic query out-of-bounds handling in logs or artifacts"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85968"
        cve = "CVE-2026-85968"
        date = "2026-01-01"

    strings:
        $cve  = "CVE-2026-85968" ascii wide nocase
        $prod = "MarkLogic" ascii wide nocase
        $ver1 = "12.0" ascii wide
        $oob1 = "out-of-bounds read" ascii wide nocase
        $oob2 = "out of bounds" ascii wide nocase
        $qp   = "query-processing" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or
        (
            $prod and
            $ver1 and
            any of ($oob*) and
            filesize < 50MB
        ) or
        $cve
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85968 Progress MarkLogic Server Out-of-Bounds Read Exploitation Attempt"; flow:established,to_server; content:"MarkLogic"; http_header; nocase; http.header; content:"POST"; http.method; content:"Content-Length"; http_header; pcre:"/(query|search|eval)/Ui"; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-dos; reference:cve,2026-85968; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85968; sid:202685968; rev:1;)

# Note: this rule is intentionally high-threshold and heuristic. Tune the pcre
# path patterns to the environment's actual MarkLogic query endpoints, as the
# NVD description does not disclose specific endpoints or parameters.

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and
      http.request.method == "POST" and
      url.path : ("*query*" or "*search*" or "*eval*") ]
  [ logs-marklogic.query where event.outcome == "failure" or
      message : ("*out of bounds*" or "*segmentation*" or "*access violation*") ]

Splunk SPL Query

index=marklogic (sourcetype=marklogic:query OR sourcetype=marklogic:server)
| search (message="*out of bounds*" OR message="*segmentation*" OR message="*access violation*" OR event_type="query_error" OR event_type="process_crash")
| stats count min(_time) as first_seen max(_time) as last_seen values(message) as evidence by src_ip, user, host
| where count >= 5
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85968,">
  <rule id="100968" level="10">
    <decoded_as>json</decoded_as>
    <field name="product">MarkLogic</field>
    <match>out of bounds|segmentation|access violation|query-processing</match>
    <description>CVE-2026-85968: Potential MarkLogic Server out-of-bounds read / query-processing anomaly detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_85968,</group>
  </rule>

  <rule id="100969" level="12">
    <if_sid>100968</if_sid>
    <field name="event_type">process_crash|service_restart</field>
    <description>CVE-2026-85968: MarkLogic Server instability consistent with out-of-bounds read exploitation</description>
    <group>cve_2026_85968,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description scopes affected releases as MarkLogic Server 12.x before 12.1.0, but no vendor advisory, no hotfix reference, and no confirmed patch artifact were returned by tracked sources. All mitigations below are therefore interim and preventive, not corrective.

1) Immediate mitigations

• Restrict network access to the MarkLogic query-processing interface to trusted networks and trusted authenticated users; enforce least privilege so that the PR:L prerequisite is as narrow as possible.
• Ensure authentication is mandatory and audit low-privilege accounts for anomalous query activity; consider temporarily limiting or monitoring the query surface until a fix is confirmed.
• Deploy the detection rules above with environment-specific tuning, and alert on MarkLogic process crashes/restarts and out-of-bounds error messages.
• Increase monitoring of availability metrics (response time, restart counts) to catch denial-of-service conditions early.

2) Patch/upgrade steps

• Verify availability of MarkLogic Server 12.1.0 (or the vendor-designated fixed release) with Progress directly. Confirm the exact fixed version and apply it after testing, since the source data does not independently confirm a published patch.
• Until a patch is confirmed by the vendor, treat affected 12.x deployments as unpatched and compensate with network segmentation, authentication hardening, and monitoring.
• Subscribe to the Progress MarkLogic security advisories channel for the authoritative fix reference.

3) Long-term hardening

• Maintain a vendor-supported version baseline and a patch-management process that tracks MarkLogic advisories.
• Adopt the principle of least privilege for all accounts permitted to reach the query interface.
• Deploy application-level and network-level rate limiting on query-processing endpoints to reduce the feasibility of stress-triggered memory faults.
• Integrate the Sigma/YARA/Suricata/Elastic/Splunk/Wazuh detections into SOC workflows and tune them periodically.

References

• NVD — CVE-2026-85968: https://nvd.nist.gov/vuln/detail/CVE-2026-85968
• Progress MarkLogic Security Advisories and Product Documentation: https://www.progress.com/marklogic (consult the vendor advisory portal for the authoritative fix reference)
• CWE-125 — Out-of-Bounds Read: https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (checked; CVE-2026-85968 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploitation / campaign status: No public proof-of-concept, exploit code, or Nuclei template was identified at the time of writing. CISA KEV status is NO. No specific threat actor campaign or confirmed exploit-in-the-wild evidence is present in the available intelligence; the attack chain described above is inferred from the vulnerability class and CVSS attributes.