CVE-2026-85974
Received Received - Intake

Progress MarkLogic Server TLS Certificate Validation Bypass

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Progress Software Corporation

Description
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-85974
EUVD
EUVD-2026-97571

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Progress Software Corporation MarkLogic Server 11.0.0
Progress Software Corporation MarkLogic Server 12.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-297 The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Progress MarkLogic Server versions before 12.1.0 and 11.3.7. It involves inconsistent validation of TLS certificate hostnames for outbound connections, allowing a network attacker to intercept or alter communications with the affected service.

Detection Guidance

To detect this vulnerability, inspect MarkLogic Server configurations for TLS certificate validation settings. Check if outbound connections are configured to validate hostnames. Use system logs to identify any intercepted or modified communications. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to eavesdrop on or tamper with data sent to or from the MarkLogic Server. This may lead to unauthorized access to sensitive information or manipulation of data in transit.

Compliance Impact

This vulnerability could violate compliance requirements that mandate secure data transmission, such as GDPR's encryption standards or HIPAA's safeguards for protected health information. Failure to address it may result in non-compliance penalties.

Mitigation Strategies

Upgrade MarkLogic Server to version 12.1.0 or later for 12.x releases, or 11.3.7 or later for 11.x releases. Ensure TLS certificate hostname validation is enabled for all outbound connections. Review and update network configurations to prevent man-in-the-middle attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85974. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart