Progress MarkLogic Server CVE-2026-85972

Exploitation requires that MarkLogic Server be deployed with Kerberos-backed, password-based (external) authentication - the flaw does not apply to instances using only internal/non-Kerberos authentication. The attacker must additionally hold a privileged on-path network position between the MarkLogic Server and the Kerberos KDC/authentication service to impersonate it (reflected in CVSS AC:H), which limits exploitation to on-path, adjacent, or compromised-network adversaries rather than arbitrary remote attackers. Affected deployments are MarkLogic 12.x before 12.1.0 and 11.x before 11.3.7; upgrading to those fixed releases removes the condition. No user interaction or prior authentication is required (UI:N/PR:N), but the non-default Kerberos configuration and the network-positioning requirement are the key limiting factors for defenders.

This is a genuine but conditional priority rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:N, 7.4 High) indicates an unauthenticated network attacker can achieve high confidentiality and integrity impact, but AC:H signals that success requires the attacker to hold a privileged position in the network path between MarkLogic and the Kerberos authentication service - a non-trivial precondition consistent with a man-in-the-middle/impersonation flaw (CWE-303). No EPSS score, CISA KEV listing, or POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. A notable signal conflict exists: the Progress advisory is titled a 'Critical Security Alert,' yet the assigned CVSS is 7.4 (High, not Critical) - verify severity framing with the vendor, as the 'Critical' label may reflect vendor messaging rather than the base score. Overall, the combination of high required attack complexity, dependence on a specific Kerberos password-based auth configuration, and absence of any exploitation signal places this below internet-facing drive-by threats but above ignorable - prioritize patching where MarkLogic uses Kerberos authentication.

An attacker who can intercept or position themselves on the network path between a MarkLogic Server and its Kerberos authentication infrastructure impersonates the trusted authentication service. Because MarkLogic insufficiently verifies the authentication service's identity in certain password-based configurations, the attacker can spoof a successful authentication and gain unauthorized read or write access to protected data. No public proof-of-concept is available, and the high attack complexity (privileged network position) makes this most realistic for an on-path or internal adversary rather than a remote opportunistic one.