Progress MarkLogic Server CVE-2026-85973

Exploitation requires that the attacker occupy an on-path (man-in-the-middle) position on the network carrying MarkLogic cluster-management communications, and that the affected deployment is running MarkLogic Server 12.x prior to 12.1.0 where those specific inter-node management channels are transmitted without encryption. Limiting factors: the attacker must already control or intercept traffic on the cluster network segment (reflected as AC:H), which in well-segmented deployments means the cluster interconnect is isolated on a trusted internal VLAN not reachable from general user networks; no authentication is needed (PR:N) and no user interaction (UI:N), but the on-path requirement substantially narrows realistic exploitation to insiders or attackers who have already achieved lateral movement. Availability is unaffected (A:N).

This is a cleartext-transmission flaw (CWE-319) in MarkLogic Server 12.x cluster-management communications, carrying a vendor CVSS of 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). The signals are internally consistent and point to a genuine-but-conditional risk rather than a drop-everything emergency: AV:N with PR:N/UI:N means no credentials or victim interaction are needed, but AC:H correctly reflects that an attacker must already hold a privileged man-in-the-middle position on the network path carrying cluster traffic - the hard part. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit or POC is referenced, so all three exploitation-likelihood signals are either absent or negative; this contrasts with the high C:H/I:H confidentiality/integrity impact and argues for a measured, patch-on-maintenance-cycle priority rather than immediate crisis response. No SSVC decision data (exploitation status, automatable, technical impact) was provided in the input and is therefore not factored. The description ('may use cleartext transport for certain cluster-management communications') is somewhat hedged about scope, so the exact subset of affected communications should be confirmed with Progress before scoping remediation.

An attacker who has gained a position on the internal network segment linking MarkLogic cluster nodes (e.g., via a compromised host, ARP spoofing, or a rogue device on the cluster VLAN) passively captures cluster-management traffic sent in cleartext, harvesting sensitive configuration or coordination data, and could actively modify that traffic in transit to tamper with cluster state. No authentication or user interaction is required, but the need for an on-path network position makes this an opportunistic insider/lateral-movement scenario rather than broad internet-facing exploitation. No public exploit code was identified in the provided data.