CVE-2026-85974 Progress Software Corporation CVE debrief

Who should care

Defenders responsible for Progress MarkLogic Server instances, particularly those with versions 11.x before 11.3.7 and 12.x before 12.1.0, should assess exposure and prioritize remediation to prevent potential interception or modification of communications.

Why it matters

CVE-2026-85974 is a high-severity vulnerability in Progress MarkLogic Server that allows network-positioned attackers to intercept or modify communications with affected services. Defenders should prioritize verifying and remediating affected instances to prevent potential security consequences.

• Verification of affected Progress MarkLogic Server instances is required to determine exposure
• Potential interception or modification of communications with affected services
• Remediation priority for versions 11.x before 11.3.7 and 12.x before 12.1.0
• Monitoring network communications for signs of exploitation

Technical summary

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections, allowing network-positioned attackers to intercept or modify communications with an affected service. This vulnerability is a high-severity issue that requires immediate attention from defenders. The improper TLS hostname verification could enable attackers to intercept or modify communications with affected services, potentially leading to security consequences. Defenders should prioritize verifying and remediating affected Progress MarkLogic Server instances, particularly those with versions 11.x before 11.3.7 and 12.x before 12.1.0.

Defensive priority

Defenders should prioritize verifying and remediating affected Progress MarkLogic Server instances, particularly those with versions 11.x before 11.3.7 and 12.x before 12.1.0, to prevent potential interception or modification of communications.

Recommended defensive actions

• Verify Progress MarkLogic Server versions and identify instances that are 11.x before 11.3.7 or 12.x before 12.1.0
• Apply vendor-provided patches or updates to affected systems
• Monitor network communications for signs of interception or modification
• Implement additional security controls to detect and prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the improper TLS hostname verification in Progress MarkLogic Server. However, the corpus does not establish specific exploitation instances or impact; therefore, verification from official sources is required.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.