MarkLogic Server EUVD-2026-97572

Exploitation requires that the MarkLogic Server is actually configured to use Amazon S3 connectivity (S3 integration feature in use) AND is left on the default cleartext transport rather than TLS, AND that the attacker can occupy an on-path/man-in-the-middle position on the network segment carrying traffic between MarkLogic and the S3 endpoint. Limiting factors that reduce real-world risk: deployments not using S3 are unaffected; enabling TLS/HTTPS transport for S3 connections mitigates the flaw; and traffic traversing only trusted/encrypted private links (VPC endpoints, VPN) denies the attacker the required interception position. Affected only on 12.x before 12.1.0 and 11.x before 11.3.7.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 HIGH) presents this as a remotely exploitable, unauthenticated confidentiality breach, but this rating overstates practical risk for a CWE-319 cleartext-transmission flaw. Realistic exploitation requires the attacker to hold an on-path (man-in-the-middle) position between the MarkLogic Server and the Amazon S3 endpoint, so the vendor's AC:L is optimistic - achieving that position is itself the hard part and is not reflected in the complexity metric. No EPSS probability, CISA KEV entry, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is a configuration/transport-hardening issue rather than a directly weaponizable RCE. Net: a legitimately important issue for organizations whose MarkLogic deployments use S3 integration over untrusted networks (credential theft can enable lateral movement into AWS), but for most deployments it is a high-CVSS-but-conditional-real-risk issue gated on both the S3 feature being used and attacker network positioning. Key missing data: EPSS, KEV, and POC status were absent from input - exploitation likelihood cannot be quantified.

An attacker who controls a segment of the network path between a MarkLogic Server and Amazon S3 (e.g. a compromised router, rogue gateway, or shared/hostile network) passively captures the cleartext S3 traffic sent by default in vulnerable 11.x/12.x builds. Because transport is unencrypted, transmitted data and AWS credentials are exposed and can be harvested and replayed against the S3 bucket or broader AWS account. No public exploit code is required - standard passive interception tooling suffices once the on-path position is held.