Read the docs
TI-2026-71190 Aliases CVE-2026-85965GHSA-9mf9-3w9j-j23g

Use-after-free in Progress MarkLogic Server JavaScript engine integration

Priority LOW 36CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

Progress MarkLogic Server releases from 12.0.0 before 12.1.0 and from 11.0.0 before 11.3.7 contain a use-after-free flaw (CWE-416) in the JavaScript engine integration. The memory-safety defect can corrupt memory, cause controlled process failure, or make the server unstable. An attacker with high privileges and changed scope can exploit it over the network with high impact on confidentiality, integrity and availability, and user interaction is not required.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine integration that could result in memory corruption, controlled process failure, or server instability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00239 15th percentileScored 2026-11-07
Fix Fixed MarkLogic Server (Progress Software Corporation): 11.3.7, 12.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressMarkLogic Server11.0.0 to before 11.3.7; 12.0.0 to before 12.1.011.3.7, 12.1.0Patch availableCNA
  • MarkLogic Server VendorProgress Affected 11.0.0 to before 11.3.7; 12.0.0 to before 12.1.0 Fixed in 11.3.7, 12.1.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:progress:marklogic_server:*:*:*:*:*:*:*:*——Progress
  • cpe:2.3:a:progress:marklogic_server:*:*:*:*:*:*:*:* Versions — — ·Progress

Remediation

Upgrade Progress MarkLogic Server 11.x to version 11.3.7 and 12.x to version 12.1.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA MarkLogic Server (Progress Software Corporation) Fixed in 11.3.7, 12.1.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Progress Software MarkLogic Server — community.progress.com/s/article/Marklogic-Critical-Securit…

    31 records Highest priority Priority MEDIUM 6 MEDIUM, 25 LOW

    Other records, highest priority first

    • TI-2026-71042 Improper privilege management in Progress MarkLogic Server XQuery functionsPriority MEDIUM 45
    • TI-2026-71043 Improper privilege management in Progress MarkLogic Server xdmp:eval-inPriority MEDIUM 44
    • TI-2026-71044 Improper privilege management in Progress MarkLogic Server backup and restorePriority MEDIUM 43
    Show all 31 records → Advisory →

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-85965
  2. 2026-10-12 Alias added: GHSA-9mf9-3w9j-j23g
  3. 2026-10-13 Priority changed: MEDIUM → LOW
  4. 2026-10-16 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-07083 Command injection in Progress LoadMaster KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-06182 WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-04541 WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-04060 Registration Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-01127 LoadMaster Pre-Authenticated OS Command Injection KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-20934 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability KEVCVSS 3.1CRITICAL 10.0
See all 436 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences