CVE-2026-85972: CWE-303: Incorrect Implementation of Authentication Algorithm in Progress Software Corporation MarkLogic Server

CVE-2026-85972 is a vulnerability in Progress Software Corporation's MarkLogic Server affecting versions >=11.0.0 <11.3.7 and >=12.0.0 <12.1.0. The issue arises from an incorrect implementation of the authentication algorithm (CWE-303), where the server insufficiently verifies the identity of a Kerberos authentication service under certain password-based authentication configurations. This weakness could be exploited by an attacker positioned on the network to impersonate the authentication service, potentially gaining unauthorized access or modifying protected data. The CVSS 3.1 score is 7.4, indicating a high severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

An attacker with network positioning could impersonate the Kerberos authentication service due to insufficient verification, potentially resulting in unauthorized access to or modification of protected data on the affected MarkLogic Server instances. The vulnerability does not affect availability. The impact is high on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Progress Software's advisories for updates and apply patches once available. Until then, consider restricting network access to trusted authentication services and monitoring for suspicious authentication activity.