CVE-2026-85973

Executive Summary

CVE-2026-85973 is a cleartext-transmission vulnerability in Progress MarkLogic Server 12.x releases prior to 12.1.0, where certain cluster-management communications may be sent without transport encryption. A network-positioned attacker who can observe the affected traffic can intercept sensitive cluster-management data and, because integrity is also impacted, may be able to modify it in transit. Organizations running unpatched MarkLogic 12.x clusters — particularly those spanning untrusted or shared network segments — are exposed to confidentiality and integrity loss rated CVSS 7.4 (High).

Technical Analysis

Progress MarkLogic Server is an enterprise NoSQL document database platform that is frequently deployed as multi-node clusters. In clustered deployments, nodes exchange internal, management-plane traffic with one another (cluster membership, configuration, and coordination messaging) in addition to serving client queries.

CVE-2026-85973 is classified under CWE-319 (Cleartext Transmission of Sensitive Information). Per the NVD description, MarkLogic Server 12.x releases before 12.1.0 "may use cleartext transport for certain cluster-management communications." In practice this means that a subset of internal, inter-node management traffic — the data exchanged to coordinate and administer the cluster — can be carried over a channel that is not protected by transport-layer cryptography such as TLS.

The core weakness is the absence of encryption (and, by consequence, of cryptographic integrity protection) on the affected management channel. Without TLS or an equivalent encrypted transport, any party with the ability to observe the network path between cluster nodes can read the traffic, and any party able to inject into that path can alter it. The vulnerability is therefore a classic on-path (man-in-the-middle) exposure: security depends entirely on the attacker not being positioned on the network path.

The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects this profile:

• AV:N (Network) — the attack is launched over the network, consistent with a flaw in network transport.
• AC:H (High) — the attacker must already occupy a network position from which the vulnerable inter-node or management traffic traverses (for example, inside the cluster VLAN, on a shared/hosted network segment, or on a routing path between nodes). This mitigates the likelihood somewhat because it is not exploitable from anywhere on the internet.
• PR:N (None) / UI:N (None) — no credentials or user interaction are required; the attacker simply needs to be on-path.
• S:U (Unchanged) — the exploited component (the cluster-management transport) is the impacted security scope; there is no scope change.
• C:H (High) / I:H (High) / A:N (None) — full loss of confidentiality and integrity for the data carried by the affected channel, but no direct availability impact. Notably, integrity impact is High: the attacker can not only read but also modify intercepted management messages.

No authentication or authorization weakness is described, and no public proof-of-concept, exploit code, or Nuclei template exists for this CVE at the time of writing. The precise set of "cluster-management communications" affected, and the exact configuration state that causes cleartext to be used (for example, a default that fails to enable encryption, or a setting that is not enforced), is not detailed in the available description. The vulnerability class — cleartext transmission that can be passively intercepted or actively modified by an on-path attacker — is well understood and does not depend on a memory-corruption or injection primitive.

Exploitation Scenarios

Because no public PoC exists, the following attack chain is inferred from the vulnerability class (CWE-319, cleartext transmission) and the CVSS vector. No specific function names, endpoints, or parameters are invented; only the behavior described in the NVD text is referenced.

1. Reconnaissance / target identification. The attacker determines whether a target runs MarkLogic Server 12.x before 12.1.0 and, crucially, whether inter-node / cluster-management traffic between nodes is reachable from a position the attacker controls. This is a precondition for exploitation: the attacker must be on the network path that the affected cluster-management communications traverse. Relevant vantage points include an internal segment overlapping the cluster's node-to-node network, a compromised host inside the same VLAN or subnet as the cluster nodes, a shared or multi-tenant hosted network, or any routed path between nodes that the attacker can observe or influence.

2. Triggering the specific flaw class. No active "trigger" is required in the traditional sense. The weakness is the use of cleartext transport for certain cluster-management communications. When nodes exchange those management messages, the traffic is transmitted without encryption. The attacker does not need to cause the condition; they only need to passively capture (or position themselves to relay) the affected traffic while it is on the wire. This differs fundamentally from injection or memory-corruption bugs — exploitation is passive observation and/or active manipulation of an unencrypted channel.

3. Payload / execution method at the vulnerability-class level. At the class level, the attacker performs one of two actions against the captured channel:

   • Interception (confidentiality): passively sniff/capture the unencrypted cluster-management traffic, disclosing its contents to the attacker.
   • Modification (integrity): because there is no cryptographic integrity protection on the cleartext channel, an on-path attacker can alter management messages in transit — for example, by tampering with, replaying, or injecting content into the stream — so that the receiving node processes attacker-influenced management data. The exact message format and injectable fields are not specified in the available description and should be determined only through vendor-supported testing or vendor guidance, not assumed.

4. Post-exploitation impact. Successful exploitation yields disclosure of information carried over the affected cluster-management channel (C:H) and the ability to corrupt or manipulate it in transit (I:H). There is no direct availability impact (A:N). Depending on what the affected management communications carry, this could expose sensitive cluster configuration/coordination data and, via tampering, allow an attacker to influence cluster-management behavior. The CVSS metrics deliberately do not assert the ability to achieve remote code execution or full cluster takeover, and none should be claimed from the available data.

Practical constraint: AC:H means the attacker must already have obtained a privileged network position. CVE-2026-85973 is therefore most relevant to threat models that include an on-path adversary — a compromised internal host, a malicious insider with network access, a supply-chain or hosting provider on the path, or an attacker who has already compromised a network device between nodes. It is not a remotely exploitable-from-the-internet flaw by itself.

Impact Assessment

Confidentiality (C:H). Information carried over the affected cleartext cluster-management communications can be read by an on-path attacker. The sensitivity of that data depends on what the management plane transmits; the NVD description does not enumerate it, so the full blast radius of disclosed data cannot be quantified from the advisory alone.

Integrity (I:H). Because the channel lacks cryptographic integrity protection, an on-path attacker can modify transmitted management data. This is the more consequential of the two impacts: manipulation of cluster-management communications could allow an attacker to influence how nodes coordinate or are administered. Again, the precise downstream effect is not specified in the available description.

Availability (A:N). No availability impact is asserted by the CVSS vector.

Attack complexity (AC:H) and privileges (PR:N/UI:N). The High complexity reflects the positional requirement (on-path access), not a technical barrier an attacker must overcome through skill. No credentials or user interaction are needed.

Business impact. Affected systems are Progress MarkLogic Server clusters running a 12.x release earlier than 12.1.0. Exposure is concentrated in multi-node deployments whose inter-node / cluster-management traffic can traverse a network segment accessible to an adversary. Because the flaw is in the management plane, impact falls on cluster administration and coordination rather than on client-facing query handling — but an attacker who can read and rewrite management traffic holds a position from which broader manipulation may be possible. There is currently no public exploit, no Nuclei template, and no CISA KEV listing, so there is no evidence of active, widespread exploitation. The primary risk is to environments that carry cluster-management traffic over shared, untrusted, or externally reachable network paths.

Detection Guidance

Detection for this CVE centers on identifying cleartext cluster-management traffic, unexpected on-path interception behavior, and anomalous management-plane activity between MarkLogic 12.x nodes. Because the vulnerability is about the absence of encryption, one of the most reliable signals is observing cluster-management protocol traffic that should be encrypted but is not.

Sigma Rule

title: Cleartext MarkLogic Cluster-Management Traffic Observed on Internal Segment
id: 5e2f1c9a-6b7d-4c1e-9a03-7d4b2f1e8a10
status: experimental
description: Detects MarkLogic cluster-management connections that appear to be transmitted without TLS encryption. Complements CVE-2026-85973 (CWE-319 cleartext transmission).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85973
author: valtersit.com
date: 2026/01/01
tags:
  - attack.collection
  - attack.t1040
  - cve.2026.85973
logsource:
  product: zeek
  service: conn
detection:
  selection_dest_port:
    id.resp_p:
      - 8000
      - 8001
      - 7997
  selection_no_tls:
    service: '-'
  condition: selection_dest_port and selection_no_tls
falsepositives:
  - Legitimate clusters that have already enabled encrypted transport
  - Non-MarkLogic services using the same ports
level: medium

Note: The port numbers above are common MarkLogic management ports and are provided as starting points; validate against your environment. The core detection intent is "cluster-management ports carrying non-TLS traffic."

YARA Rule

rule CVE_2026_85973_Cleartext_MarkLogic_ClusterMgmt
{
    meta:
        author = "valtersit.com"
        description = "Heuristic detection of cleartext MarkLogic cluster-management payloads. Detects management-plane banner/identity strings transmitted without TLS envelope. Low confidence - tune to your environment."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85973"
        cve = "CVE-2026-85973"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $mk = "MarkLogic" ascii nocase
        $cm1 = "cluster" ascii nocase
        $cm2 = "manage" ascii nocase

    condition:
        $mk and (any of ($cm*)) and filesize < 64KB
}

Note: This is a heuristic content rule. It will not confirm a TLS-transport decision; it only highlights unencrypted payloads containing MarkLogic cluster/management identifiers for analyst review.

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 8000 (msg:"CVE-2026-85973 Potential Cleartext MarkLogic Cluster-Management Traffic"; flow:to_server,established; content:"MarkLogic"; nocase; depth:200; classtype:policy-violation; sid:202685973; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_85973;)

This rule flags cluster-management traffic carrying the MarkLogic identifier that is not wrapped in TLS. Confirm that the target port matches your deployment's inter-node management port. To detect the transport issue more directly, pair this with TLS-fingerprint / JA3 absence checks in your platform.

Elastic Detection

sequence by host.id with maxspan=5m
  [ network where destination.port in (8000, 8001, 7997) and
      not network.protocol == "tls" and
      network.transport == "tcp" ]

Intended semantics: alert on internal network flows to MarkLogic cluster-management ports that are not TLS-encrypted. Adjust destination.port to your environment. This is a policy/transport anomaly signal for CVE-2026-85973 rather than direct exploit detection.

Splunk SPL Query

index=network sourcetype=zeek:conn OR sourcetype=pan:traffic
| search dest_port IN (8000,8001,7997)
| search NOT (service="ssl" OR app="ssl" OR proto="tls")
| stats count min(_time) as first_seen max(_time) as last_seen values(src) as src values(dest) as dest by dest_port
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Identifies internal hosts connecting to MarkLogic cluster-management ports without TLS. Tune the port list and the service/app fields to your telemetry. Absence of TLS on these ports is the CVE-2026-85973 signal.

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85973,">
  <rule id="100873" level="7">
    <decoded_as>json</decoded_as>
    <field name="dest_port">^8000$|^8001$|^7997$</field>
    <field name="tls_enabled">^false$</field>
    <description>Potential cleartext MarkLogic cluster-management traffic (CVE-2026-85973 / CWE-319)</description>
    <mitre>
      <id>T1040</id>
    </mitre>
    <group>configuration_error,pci_dss_4.1,</group>
  </rule>
</group>

Assumes your network telemetry is normalized to JSON with dest_port and tls_enabled fields. Adjust field names to match your ingestion pipeline. The rule fires when management-plane traffic to MarkLogic ports lacks TLS, which is the core condition of this CVE.

General detection note: Because the flaw is the absence of encryption, the highest-value detection is a transport-visibility check — alert whenever inter-node traffic to MarkLogic management ports is observed without a TLS session. Complement this with host/audit logs for unexpected configuration changes to the cluster-management transport between nodes.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory URL, patch commit, or workaround is currently recorded for CVE-2026-85973. The NVD description states the issue is addressed in MarkLogic Server 12.1.0; treat that version as the target remediation baseline, and confirm directly with Progress before relying on it.

1) Immediate mitigations (compensating controls).

• Segment cluster-management traffic. Place inter-node / cluster-management communications on a dedicated, isolated network segment or VLAN that is not reachable by general user hosts, multi-tenant workloads, or any untrusted system. This directly neutralizes the on-path attacker precondition (AC:H).
• Encrypt in transit at the network layer. Where MarkLogic's own transport cannot yet be forced to encrypt, wrap inter-node management traffic in an encrypted tunnel (for example, IPsec or a mutually authenticated VPN between cluster nodes). This restores confidentiality and integrity even while the application uses cleartext.
• Restrict east-west reachability. Apply host-based and network firewalls so that only the cluster nodes can reach the management ports of other nodes, and deny management-plane access from client or corporate subnets.
• Monitor for the cleartext condition. Use the detection guidance above to identify management traffic that is still unencrypted and prioritize those clusters for upgrade or tunneling.

2) Patch / upgrade steps.

• Plan an upgrade of affected clusters from any 12.x release earlier than 12.1.0 to 12.1.0 or later.
• Before upgrading, confirm the fix and the exact remediation version with Progress (vendor advisory not yet available in tracked sources). Verify whether 12.1.0 changes the default transport behavior or requires an explicit configuration change to enable encrypted cluster management.
• Because this is a management-plane issue affecting multiple nodes, upgrade and restart cluster members in a coordinated manner per standard MarkLogic upgrade procedures, and verify that inter-node management traffic is encrypted after the upgrade.

3) Long-term hardening.

• Establish and enforce a configuration baseline requiring encryption for all inter-node and management-plane communication; validate it continuously with the transport-visibility detections above.
• Maintain strict network segmentation between the cluster's data/management planes and all other network zones; treat the node-to-node network as a high-trust-only path.
• Track Progress MarkLogic security advisories and CVE feeds; as of this writing there is no public exploit, no PoC, no Nuclei template, and no CISA KEV entry, so detection and segmentation are the primary defenses.
• Include the management plane in penetration tests and architecture reviews so that on-path exposure of internal administration traffic is identified before an adversary does.

References

• NVD — CVE-2026-85973: https://nvd.nist.gov/vuln/detail/CVE-2026-85973
• CWE-319 — Cleartext Transmission of Sensitive Information: https://cwe.mitre.org/data/definitions/319.html
• Progress MarkLogic Server product/security documentation (verify current advisory and 12.1.0 fix status directly with the vendor; no advisory URL is recorded in tracked sources).
• MITRE ATT&CK T1040 — Network Sniffing: https://attack.mitre.org/techniques/T1040/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85973 is not listed at the time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No public exploit, proof-of-concept, Nuclei template, or exploit code is known for CVE-2026-85973, and there is no evidence of active exploitation or KEV listing. At the time of writing, EPSS has not yet assigned a score. Any observed exploitation would most plausibly come from an on-path adversary already positioned inside the cluster's network path (for example, a compromised internal host or a malicious network/hosting provider), consistent with the AC:H rating.