CVE-2026-85972

Executive Summary

CVE-2026-85972 is an authentication identity-verification flaw (CWE-303) in Progress MarkLogic Server releases 12.x before 12.1.0 and 11.x before 11.3.7. In certain password-based authentication configurations, the server does not sufficiently verify the identity of a Kerberos authentication service, allowing a network-positioned attacker to impersonate trusted authentication infrastructure. Successful exploitation can result in unauthorized access to or modification of protected data, yielding high confidentiality and integrity impact (CVSS 7.4).

Technical Analysis

The vulnerability class is CWE-303: Incorrect Implementation of Authentication Algorithm. Per the NVD description, the affected MarkLogic Server releases "do not sufficiently verify the identity of a Kerberos authentication service in certain password-based authentication configurations." This is fundamentally a trust-establishment failure in the authentication handshake: the server accepts assertions from an authentication service without adequately validating that the service is the legitimate, trusted Kerberos principal it claims to be.

Kerberos-based authentication relies on mutual verification between the client, the service, and the Key Distribution Center (KDC). When a service or intermediary does not correctly verify the identity of the Kerberos authentication service it is communicating with, an attacker who can occupy a network position on the authentication path can present themselves as that service. Because the flaw is scoped to "certain password-based authentication configurations," the vulnerable condition is configuration-dependent rather than universal — deployments that rely on password-based Kerberos authentication flows are the relevant attack surface. The CVSS vector reflects this: AC:H (High attack complexity) indicates the attacker must meet preconditions such as network positioning and a specific target configuration, while PR:N and UI:N indicate no prior privileges or user interaction are required. The C:H/I:H/A:N subscores confirm the primary consequences are disclosure and tampering of protected data, with no direct availability impact.

Critically, the NVD description does not name specific functions, classes, API endpoints, protocol messages, or configuration parameters. No public proof-of-concept, exploit code, or Nuclei template is available, and no vendor patch source has been confirmed. Analysis beyond the vulnerability class and its described mechanism would require fabrication and is therefore avoided here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-303) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a MarkLogic Server deployment running an affected release (12.x before 12.1.0 or 11.x before 11.3.7) that is configured to use password-based Kerberos authentication. Fingerprinting is feasible where the service exposes identifying banners or management interfaces.

2. Positioning. This is an adversary-in-the-middle class attack (T1557). The attacker must achieve a network position on the path between the MarkLogic Server and the Kerberos authentication service — for example, through traffic redirection, ARP/route manipulation, or control of an intermediary host. The AC:H rating reflects the difficulty of reliably achieving this position against a specific configuration.

3. Impersonation of the authentication service. Because the server "does not sufficiently verify the identity of a Kerberos authentication service," the attacker presents itself as the trusted authentication infrastructure. The server accepts the impersonated service rather than validating its true identity via Kerberos's mutual-authentication guarantees. The specific protocol messages or fields that are mishandled are not disclosed in the available data.

4. Post-exploitation impact. Once the impersonated authentication service is trusted, the attacker can influence the authentication outcome, potentially authenticating as legitimate users or otherwise gaining access. This results in unauthorized access to protected data (C:H) and the ability to modify it (I:H), consistent with the CVSS impact subscores.

Impact Assessment

Successful exploitation yields high confidentiality and integrity impact (C:H/I:H) with no availability impact (A:N), for a base score of 7.4 (High). Affected systems are MarkLogic Server deployments on 12.x (before 12.1.0) and 11.x (before 11.3.7) that use password-based Kerberos authentication configurations. MarkLogic is typically deployed as a mission-critical enterprise data platform, so compromise can expose or corrupt regulated, proprietary, or otherwise sensitive datasets — including any data for which the affected service is the authoritative store. Blast radius is bounded by the deployment's role within the enterprise and the privileges reachable through the authentication path. The absence of user interaction (UI:N) and prior privileges (PR:N) means a successful position-based attacker needs no insider assistance, though the high attack complexity limits mass exploitation.

Detection Guidance

Sigma Rule

title: Potential Kerberos Authentication Service Impersonation Against MarkLogic Server
id: 4b7c2f10-9a3e-4d6e-b1c2-0f5a8d3e7c91
status: experimental
description: Detects authentication events consistent with CVE-2026-85972, where MarkLogic Server fails to verify the identity of a Kerberos authentication service in password-based configurations.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85972
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: marklogic
  service: authentication
detection:
  selection_event:
    event_type:
      - 'authentication_success'
      - 'authentication_failure'
  selection_kerberos:
    auth_protocol|contains: 'kerberos'
  selection_anomaly:
    - src_ip|cidr: '0.0.0.0/0'   # placeholder: correlate with untrusted source range
    - authentication_service|endswith: '$@'
  condition: selection_event and selection_kerberos
fields:
  - src_ip
  - user
  - authentication_service
  - event_type
falsepositives:
  - Legitimate Kerberos service tickets during normal authentication
level: medium

YARA Rule

rule CVE_2026_85972_MarkLogic_Kerberos_Auth_Anomaly
{
    meta:
        description = "Detects configuration indicators of MarkLogic Server Kerberos authentication service verification weakness (CVE-2026-85972)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85972"
        author = "Threat Intelligence"
        date = "2026-01-01"
        cve = "CVE-2026-85972"
    strings:
        $ml1 = "MarkLogic" ascii nocase
        $ml2 = "marklogic" ascii nocase
        $krb1 = "Kerberos" ascii nocase
        $krb2 = "krb5" ascii nocase
        $cfg1 = "authentication" ascii nocase
    condition:
        (any of ($ml1, $ml2)) and (any of ($krb1, $krb2)) and $cfg1
}

Suricata IDS Rule

alert tcp any any -> any 88 (msg:"CVE-2026-85972 Possible Kerberos Authentication Service Impersonation Against MarkLogic Server"; flow:to_server,established; content:"|6a 81|"; depth:2; byte_test:1,>,100,0; threshold:type both,track by_src,count 20,seconds 60; classtype:attempted-user; reference:cve,2026-85972; metadata:affected_product MarkLogic_Server; sid:2026859720; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.transport == "tcp" and destination.port == 88 ]
  [ authentication where event.outcome == "success" and user.name != null ]

Splunk SPL Query

index=marklogic OR index=security (authentication OR kerberos OR auth_service)
| search ("kerberos" OR "auth_service" OR "KDC")
| where (status="success" OR status="unknown") AND src_ip!="<trusted_auth_service_ips>"
| stats count values(dest) values(user) values(status) by src_ip
| where count > 5
| sort -count

Wazuh OSSEC Rule

<group name="marklogic,authentication,">
  <rule id="100972" level="10">
    <decoded_as>json</decoded_as>
    <field name="auth_protocol">kerberos</field>
    <field name="status">success</field>
    <description>CVE-2026-85972: Possible Kerberos authentication service impersonation against MarkLogic Server</description>
    <mitre>
      <id>T1557</id>
    </mitre>
    <group>authentication_anomaly,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Isolate authentication traffic: ensure MarkLogic Server communicates with its Kerberos authentication service only over trusted, non-hijackable network segments (dedicated VLANs, no shared broadcast domains with untrusted hosts).
   • Where feasible, switch off password-based Kerberos authentication configurations in favor of mechanisms that enforce strong mutual authentication, or tighten trust relationships so only known KDC endpoints are reachable.
   • Enforce network-layer protections against MITM positioning (802.1X, Dynamic ARP Inspection, DHCP snooping, encrypted/signed authentication channels).
   • Monitor authentication logs for anomalous service principals or unexpected source IPs on port 88.

2. Patch/upgrade steps.

   • Upgrade MarkLogic Server to 12.1.0 or higher on the 12.x line, or 11.3.7 or higher on the 11.x line, per the NVD-stated fixed version boundaries. No vendor patch reference has been confirmed by tracked sources; verify the fix directly with Progress before relying on the version boundary.

3. Long-term hardening.

   • Adopt strict Kerberos service principal verification and mutual authentication across authentication integrations.
   • Continuously inventory and version-track MarkLogic deployments to close the exposure window for unpatched releases.
   • Reduce reliance on password-based authentication flows and prefer certificate- or hardware-backed authentication with explicit trust pinning.

References

• NVD — CVE-2026-85972: https://nvd.nist.gov/vuln/detail/CVE-2026-85972
• CWE-303, Incorrect Implementation of Authentication Algorithm: https://cwe.mitre.org/data/definitions/303.html
• MITRE ATT&CK T1557, Adversary-in-the-Middle: https://attack.mitre.org/techniques/T1557/
• Progress MarkLogic product documentation and security advisories: https://www.progress.com/marklogic
• CISA Known Exploited Vulnerabilities catalog (no entry for CVE-2026-85972 as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public exploit code, PoC, or Nuclei template has been identified. No confirmed in-the-wild exploitation or named threat actor campaign is associated with CVE-2026-85972 in the available data.