CVE-2026-85972 | BDVDB-2026-386018 Detail

Description#

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-12Record published in the CVE List.
2. Version 22026-10-14Most recent update recorded in the CVE List.