CVE-2026-85974: CWE-297: Improper Validation of Certificate with Host Mismatch in Progress Software Corporation MarkLogic Server

CVE-2026-85974 describes an improper validation of TLS certificate hostnames in Progress Software Corporation's MarkLogic Server. Specifically, versions 11.x before 11.3.7 and 12.x before 12.1.0 do not consistently validate the hostname in TLS certificates for some outbound connections. This weakness could be exploited by an attacker positioned on the network to intercept or modify communications by exploiting the host mismatch in the certificate validation process. The vulnerability is categorized under CWE-297 (Improper Validation of Certificate with Host Mismatch) and has a CVSS 3.1 base score of 7.4, reflecting high impact on confidentiality and integrity without affecting availability.

Successful exploitation of this vulnerability could allow an attacker with network positioning to intercept or modify communications between the MarkLogic Server and other services. This compromises confidentiality and integrity of the data transmitted over TLS connections where the hostname validation is bypassed or inconsistent. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

The vendor has identified affected versions as 11.0.0 up to but not including 11.3.7 and 12.0.0 up to but not including 12.1.0. While no explicit patch or remediation link is provided in the input data, the presence of fixed versions (11.3.7 and 12.1.0) implies that upgrading to these or later versions will remediate the vulnerability. Users should upgrade MarkLogic Server to version 11.3.7 or later, or 12.1.0 or later, to address this issue. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for the latest remediation guidance.