CVE-2026-85976 Progress Software Corporation CVE debrief

Who should care

Defenders responsible for Progress MarkLogic Server deployments, particularly those using versions 11.x prior to 11.3.7 or 12.x prior to 12.1.0, should assess exposure and prioritize patching or mitigation.

Why it matters

Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential HTTP response splitting attacks in Progress MarkLogic Server Query Console.

• Potential for HTTP response splitting attacks leading to client-side response handling.
• Need for verification of exposure and application of patches or mitigations.
• Possible impact on data integrity and confidentiality.
• Requirement for monitoring and incident response planning.

Technical summary

The vulnerability in Progress MarkLogic Server Query Console allows for HTTP response splitting due to insufficient input sanitization. This issue affects MarkLogic Server 11.x versions prior to 11.3.7 and 12.x versions prior to 12.1.0. The vulnerability can lead to unintended client-side response handling, potentially impacting data integrity and confidentiality. The CVE record and source item provide details on the vulnerability, affected versions, and a reference to a vendor advisory. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential HTTP response splitting attacks.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential HTTP response splitting attacks.

Recommended defensive actions

• Verify exposure by checking if MarkLogic Server versions 11.x prior to 11.3.7 or 12.x prior to 12.1.0 are in use.
• Apply patches or mitigations as recommended by the vendor.
• Monitor for potential HTTP response splitting attacks.
• Review and update incident response plans to address potential consequences of successful attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and a reference to a vendor advisory. The vulnerability in Progress MarkLogic Server Query Console allows for HTTP response splitting due to insufficient input sanitization. This issue affects MarkLogic Server 11.x versions prior to 11.3.7 and 12.x versions prior to 12.1.0. The source item provides details on the vulnerability and affected versions. The CVE Program record with source-provided CVE metadata and the official NIST NVD detail page and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.