CVE-2026-85974: Improper TLS hostname verification in Progress MarkLogic Server
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments are affected?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. The issue applies to certain outbound connections whose TLS certificate hostname validation is not performed consistently.
What access does an attacker need to exploit this issue?
An attacker must be positioned on the network path for the affected outbound communications. No authentication or user interaction is required according to the provided vector.
What could an attacker do if exploitation succeeds?
A network-positioned attacker could intercept or modify communications with an affected service. The stated impact includes high confidentiality and integrity impact, with no availability impact listed.