CVE-2026-85972

HighCVSS 7.4/10Last modified Oct 15, 2026

Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. A network-positioned attacker could impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-303

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Progress Software Corporation	MarkLogic Server	>= 11.0.0, < 11.3.7; >= 12.0.0, < 12.1.0

References

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026

Timeline

Published: Oct 12, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-859737.4Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-p CVE-2026-859747.4Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames CVE-2026-859757.5Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections CVE-2026-859765.4Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query C CVE-2026-859775.3A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a clien CVE-2026-859789.8An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization disc CVE-2026-859798.6Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privilege CVE-2026-85989.1An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication an CVE-2026-859816.7The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiri CVE-2026-859829.0The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search result CVE-2026-859837.8The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host CVE-2026-859849.8The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login