Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos… (CVE-2026-85972)

The vulnerability in Progress MarkLogic Server 12.x (before 12.1.0) and 11.x (before 11.3.7) involves insufficient verification of the identity of a Kerberos authentication service when using certain password-based authentication configurations. This weakness could be exploited by an attacker positioned on the network to impersonate trusted authentication infrastructure, which may result in unauthorized access or modification of sensitive data within the system. The CVSS v3.1 base score is 7.4, indicating a high severity with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability.

An attacker who can position themselves on the network could exploit this vulnerability to impersonate the Kerberos authentication service. This could lead to unauthorized access to the system or unauthorized modification of protected data. The vulnerability affects the confidentiality and integrity of the system but does not impact availability.

A fix is available in Progress MarkLogic Server versions 12.1.0 and 11.3.7 and later. Users should upgrade to these or later versions to remediate the vulnerability. Since the vendor advisory or patch links were not provided, verify the patch status with the official vendor advisory before applying updates. No cloud service remediation applies as this is not a cloud service.