CVE-2026-85972: Improper Kerberos server verification in Progress MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments are affected?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected when using certain password-based Kerberos authentication configurations.
What does an attacker need to exploit this issue?
The attacker must be in a network position that allows them to impersonate trusted Kerberos authentication infrastructure. No prior privileges or user interaction are required according to the supplied vector.
What is the likely impact of successful exploitation?
An attacker may gain unauthorized access to protected data or modify protected data. The provided severity vector indicates high confidentiality and integrity impact, with no availability impact.
How can this be remediated?
Upgrade 12.x deployments to 12.1.0 or later, or 11.x deployments to 11.3.7 or later.