CVE-2026-85975: CWE-319: Cleartext Transmission of Sensitive Information in Progress Software Corporation MarkLogic Server

CVE-2026-85975 describes a vulnerability in Progress Software Corporation's MarkLogic Server where versions 11.x before 11.3.7 and 12.x before 12.1.0 may use unencrypted transport for Amazon S3 connections by default. This cleartext transmission of sensitive information (CWE-319) could allow an attacker positioned on the network path to intercept data or credentials sent through these connections. The vulnerability has a CVSS 3.1 score of 7.5, indicating high severity. A patch is available to remediate this issue.

An attacker with network access could intercept sensitive data or credentials transmitted in cleartext over affected Amazon S3 connections, potentially leading to unauthorized data disclosure. There is no indication of impact to data integrity or availability. No known exploits are reported in the wild at this time.

A patch is available for this vulnerability. Users should upgrade MarkLogic Server to version 11.3.7 or later for the 11.x branch, and to version 12.1.0 or later for the 12.x branch to ensure encrypted transport is used for Amazon S3 connections. Since this is a cloud service, the vendor typically manages remediation server-side; however, customers should verify their deployment versions and apply updates accordingly.