Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. (CVE-2026-85973)

CVE-2026-85973 describes a vulnerability in Progress MarkLogic Server 12.x releases before 12.1.0 where certain cluster-management communications are sent using cleartext transport. This flaw enables an attacker with network access to intercept or alter information exchanged between cluster nodes, potentially compromising confidentiality and integrity of cluster management data. The vulnerability has a CVSS 3.1 base score of 7.4, indicating high severity, with attack vector network, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker positioned on the network path between cluster nodes can intercept or modify cluster-management communications sent in cleartext. This compromises the confidentiality and integrity of sensitive cluster management information, potentially leading to unauthorized access or manipulation of cluster operations. There is no indication of impact on availability. No known exploits in the wild have been reported.

A fix is available in Progress MarkLogic Server version 12.1.0. Users should upgrade to version 12.1.0 or later to ensure cluster-management communications are properly protected. Until upgraded, network-level protections such as VPNs or encrypted tunnels may reduce exposure. Patch status is not explicitly confirmed beyond the version indicating the fix; users should consult the vendor advisory for the latest remediation guidance.