CVE-2026-85972 Progress Software Corporation CVE debrief

Who should care

Defenders responsible for Progress MarkLogic Server instances, particularly those using Kerberos authentication, should assess exposure and prioritize updates and monitoring. This includes operators managing affected systems, vulnerability management teams, and security teams responsible for reviewing and adjusting authentication configurations.

Why it matters

Defenders should prioritize verifying and updating Progress MarkLogic Server instances, reviewing authentication configurations, and monitoring for suspicious activity due to the potential for unauthorized access or modification of protected data.

• Potential unauthorized access to protected data
• Potential modification of protected data
• Need to verify and update Progress MarkLogic Server instances to the latest versions
• Need to review and adjust authentication configurations for proper Kerberos server verification

Technical summary

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations. This vulnerability allows a network-positioned attacker to impersonate trusted authentication infrastructure, potentially resulting in unauthorized access or modification of protected data.

Defensive priority

Defenders should prioritize verifying and updating Progress MarkLogic Server instances to the latest versions, reviewing authentication configurations, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and update Progress MarkLogic Server instances to the latest versions (12.1.0 or later for 12.x, 11.3.7 or later for 11.x)
• Review authentication configurations to ensure proper Kerberos server verification
• Monitor for suspicious activity and implement additional security measures as needed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential impact. However, additional information on exploitation or specific attacks is not available. The source item and CVE record indicate that Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. Limited evidence suggests that this vulnerability could be exploited for unauthorized access or modification of protected data. Further verification is needed to confirm the extent of potential harm.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.