Progress MarkLogic Server EUVD-2026-97571

Exploitation requires that MarkLogic Server initiate one of the specific outbound connections that fail to validate the TLS certificate hostname, AND that the attacker occupy a man-in-the-middle / on-path position in the network between the server and the remote endpoint (e.g., via ARP/DNS spoofing, rogue gateway, or control of intermediate network infrastructure). The limiting factors are substantial: the attacker cannot exploit this purely remotely without first achieving network interception capability (reflected in CVSS AC:H), exploitation only affects the subset of 'certain outbound connections' identified by the vendor rather than all TLS traffic, and only pre-patch versions (12.x < 12.1.0, 11.x < 11.3.7) are vulnerable. There is no availability impact and no code execution - impact is confined to interception and modification of the affected communications.

The input CVSS of 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects a man-in-the-middle class weakness (CWE-297, improper certificate hostname validation) with high confidentiality and integrity impact but no availability impact. The AV:N/PR:N metrics indicate a network, unauthenticated vector, but the AC:H metric is the critical risk modifier: exploitation requires the attacker to already hold a privileged on-path/network-positioned role, which is not generally available to arbitrary remote attackers. No EPSS score, CISA KEV listing, or POC was provided in the input; therefore exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - there is no CVSS-versus-description conflict - but they point to a conditional, targeted threat (requires network interception capability) rather than mass, remotely-automatable exploitation. Net assessment: a genuine confidentiality/integrity concern for MarkLogic's outbound/service-to-service TLS trust, warranting patching, but not an emergency 'exploited-in-the-wild' priority on current evidence. Absence of EPSS/KEV/POC is a data gap, not proof of safety.

An attacker who already controls a segment of the network path (e.g., a compromised router, rogue DHCP/DNS, or ARP-spoofed LAN) between MarkLogic Server and a remote service it connects to presents a fraudulent TLS certificate for the target hostname. Because MarkLogic does not consistently validate the certificate hostname on certain outbound connections, the forged certificate is accepted, allowing the attacker to decrypt, inspect, and alter the traffic. No public exploit is identified at time of analysis, and the AC:H rating reflects that a suitable on-path position must first be achieved.