Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-85965— Use-after-free in Progress MarkLogic Server JavaScript engine integration

Quick assessment

Affected

Progress Software Corporation MarkLogic Server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Progress MarkLogic Server 12.x 在 12.1.0 版本之前以及 11.x 在 11.3.7 版本之前的版本中，JavaScript 引擎集成存在内存安全缺陷，可能导致内存损坏、受控的进程崩溃或服务器不稳定。

CVSS 8.0 · High EPSS 0.24% · P14 Updated Oct 13, 2026

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 2

Vendor	Product	Version Range	Status
Progress Software Corporation	MarkLogic Server	`11.0.0< 11.3.7`	affected
		`12.0.0< 12.1.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Use-after-free in Progress MarkLogic Server JavaScript engine integration

Source: CVE Program / CVE List V5

Vulnerability Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

释放后使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Progress Software Corporation	MarkLogic Server	11.0.0 ~ 11.3.7	-

II. Public POCs for CVE-2026-85965

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-85965

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-85965 (1)

🔗 Marklogic Critical Security Alert Bulletin – October 2026 - Progress Community Read full article vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-85965

Same Patch Batch · Progress Software Corporation · 2026-10-12 · 31 CVEs total

CVE-2026-85947	9.9 CRITICAL	Improper privilege management in Progress MarkLogic Server forest operations
CVE-2026-85948	9.9 CRITICAL	Improper privilege management in Progress MarkLogic Server Management API
CVE-2026-85955	9.9 CRITICAL	Improper privilege management in Progress MarkLogic Server xdmp:eval-in
CVE-2026-85956	9.6 CRITICAL	Improper privilege management in Progress MarkLogic Server backup and restore operations
CVE-2026-9191	9.6 CRITICAL	Insufficient isolation of user-supplied code in Progress MarkLogic Server
CVE-2026-85954	8.6 HIGH	Improper privilege management in Progress MarkLogic Server higher-order XQuery functions
CVE-2026-85951	8.5 HIGH	Server-side request forgery in Progress MarkLogic Server Azure deployments
CVE-2026-85952	8.5 HIGH	Server-side request forgery in Progress MarkLogic Server Linux cloud deployments
CVE-2026-85953	8.5 HIGH	Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio
CVE-2026-85950	8.4 HIGH	Improper privilege management in Progress MarkLogic Server REST extensions
CVE-2026-85949	8.1 HIGH	Sensitive information exposure in Progress MarkLogic Server trace logs
CVE-2026-85966	7.7 HIGH	Exposure of sensitive information in Progress MarkLogic Server
CVE-2026-85964	7.7 HIGH	Path traversal in Progress MarkLogic Server Query Console
CVE-2026-85960	7.5 HIGH	Cross-site request forgery in Progress MarkLogic Server Query Console
CVE-2026-85975	7.5 HIGH	Cleartext transmission in Progress MarkLogic Server Amazon S3 connections
CVE-2026-85963	7.5 HIGH	Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector
CVE-2026-85958	7.5 HIGH	Improper OAuth token validation in Progress MarkLogic Server
CVE-2026-85961	7.5 HIGH	Sensitive information exposure in Progress MarkLogic Server Azure deployments
CVE-2026-85957	7.5 HIGH	Improper XML external entity restriction in Progress MarkLogic Server SAML processing
CVE-2026-85962	7.5 HIGH	Improper authentication in Progress MarkLogic Server SAML processing

Showing top 20 of 31 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: MarkLogic Server

Same vendor: Progress Software Corporation

Same weakness: CWE-416

V. Comments for CVE-2026-85965

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-85965— Use-after-free in Progress MarkLogic Server JavaScript engine integration

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 2

I. Basic Information for CVE-2026-85965

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-85965

III. Intelligence Information for CVE-2026-85965

Vendor Advisories for CVE-2026-85965 (1)

Same Patch Batch · Progress Software Corporation · 2026-10-12 · 31 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-85965

Leave a comment