CVE-2026-85974

Executive Summary

CVE-2026-85974 is a TLS certificate hostname validation weakness in Progress MarkLogic Server affecting 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. The product does not consistently validate TLS certificate hostnames for certain outbound connections, allowing a network-positioned attacker to intercept or modify communications with an affected service. With a CVSS base score of 7.4 (High), the flaw undermines the integrity and confidentiality of server-to-server traffic without requiring authentication or user interaction.

Technical Analysis

The vulnerability is classified under CWE-297: "Improper Validation of Certificate with Host Mismatch." In a correctly implemented TLS client, the hostname in the server's X.509 certificate (or Subject Alternative Name extension) must be matched against the hostname the client intended to reach. RFC 6125 describes this verification step. When a client skips or inconsistently performs hostname verification, it will accept any certificate chaining to a trusted root — meaning an attacker who can present any validly-issued certificate (including one for an unrelated domain) can terminate the TLS session and impersonate the intended endpoint.

Per the NVD description, MarkLogic Server fails to consistently validate certificate hostnames for "certain outbound connections." This implies that the server acts as a TLS client in some outbound communication flows (for example, connections to clustered nodes, remote services, or analogous backend integrations), and that for these specific connection types the hostname-matching check is either skipped or applied only on some code paths. The word "inconsistently" is significant: it suggests the defect is not a blanket disablement of TLS verification across the product, but rather a non-uniform implementation in which some outbound code paths enforce hostname validation and others do not. This increases audit difficulty, as operators may believe TLS verification is globally enforced when it is only enforced on a subset of connections.

No specific function names, classes, configuration parameters, or code paths are provided in the available advisory text. Consequently, this report does not assert implementation-level details beyond what the NVD description states. The observable security consequence is a gap in the trust establishment phase of TLS for outbound connections, which is a prerequisite for any adversary-in-the-middle (AiTM) attack against those flows.

The CVSS vector reflects the risk profile accurately: AV:N (network exploitable), AC:H (high attack complexity, consistent with a network-positioned attacker needing to intercept or redirect traffic), PR:N (no privileges required), UI:N (no user interaction), S:U (scope unchanged), C:H and I:H (high confidentiality and integrity impact on the affected communications), and A:N (no direct availability impact).

Because certificate validation is only effective when the client verifies chain trust AND hostname identity, this class of flaw is comparable to known real-world defects such as CVE-2020-13777 (GnuTLS session resumption bypass) and the numerous "improper certificate validation" CVEs historically tracked under CWE-295/CWE-297. The common outcome is that encrypted channels that appear secure to operators are in fact susceptible to transparent interception and modification.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-85974, and no exploit code or Nuclei template has been observed. The following attack chain is inferred strictly from the vulnerability class (improper TLS certificate hostname validation) and the NVD description. It does not reference any implementation detail not present in the advisory.

1. Reconnaissance / target identification. The attacker determines that a target organization operates MarkLogic Server in an affected version (12.x before 12.1.0, or 11.x before 11.3.7). Because the flaw affects outbound connections, the attacker focuses on network paths the MarkLogic node uses to reach other systems — for example, inter-node or service-to-service traffic within a cluster or to external endpoints. A network-positioned attacker (adjacent segment, compromised transit link, rogue access point, or malicious upstream service) is required, as reflected by AC:H.

2. Triggering the flaw class. When MarkLogic initiates an outbound TLS connection over a path where hostname validation is not consistently enforced, the client completes a handshake with whatever endpoint the attacker presents, provided the attacker's certificate chains to a CA the client trusts (or, depending on configuration, any certificate). The attacker's certificate does not need to match the intended hostname; the hostname check is the very control that is missing or inconsistent.

3. Payload / execution method (class level). The attacker performs a standard Adversary-in-the-Middle positioning step (traffic redirection via ARP/DNS manipulation, BGP hijack, or malicious proxy) and terminates the outbound TLS connection with their own certificate. Because hostname validation fails to catch the mismatch, the MarkLogic side accepts the session as legitimate. From that point forward, all application-layer content on the connection is readable and writable by the attacker.

4. Post-exploitation impact. The attacker can read sensitive data transmitted over the hijacked outbound connection (C:H) and can alter it in transit (I:H). Because the affected connections are server-to-server, this may include credentials, queries, or data payloads that downstream systems trust as coming from an authenticated MarkLogic node. The modifications need not be visible to the MarkLogic operator, since the TLS layer reports a successful, trusted connection.

Absent a patch (see Mitigation & Patch Guidance), any organization with affected versions that depends on outbound TLS to untrusted network paths should treat those channels as potentially interceptable.

Impact Assessment

The CVSS base score is 7.4 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. The confidentiality and integrity subscores are both High, reflecting that a successful AiTM attacker can both read and modify the affected communications. There is no availability impact (A:N), and the scope is unchanged (S:U), meaning the compromised component itself is the primary affected asset rather than a pivot to a different security authority within the same evaluation.

Business impact centers on the data flowing through MarkLogic's outbound connections. MarkLogic is commonly deployed as an enterprise data platform and operational database; outbound TLS connections may carry query traffic, replication or synchronization data, and integration payloads to other systems. Interception of these channels can expose regulated or proprietary data and, more seriously, allow integrity violations — injected or altered records that downstream consumers treat as authentic. Regulatory exposure (data-in-transit confidentiality requirements, data-integrity obligations) is plausible for affected organizations.

Blast radius depends on deployment topology. Clusters with inter-node traffic traversing shared or untrusted network segments, and deployments that integrate with externally hosted or third-party services, carry the highest exposure. Single-node deployments with no outbound TLS reliance on untrusted paths have reduced exposure. EPSS has not yet been scored by FIRST.org; no CISA KEV listing exists; and the provisional patch confidence is 0/4, meaning no patch evidence was identified from tracked sources at the time of writing (the fixed versions 12.1.0 and 11.3.7 are identified in the advisory text).

Detection Guidance

Sigma Rule

title: MarkLogic Outbound TLS Certificate Hostname Mismatch Attempt
id: 7c1e1a44-26b6-4c2a-9a3e-6a91a6e5f001
status: experimental
description: Detects repeated outbound TLS handshake failures or certificate verification events that may indicate an adversary-in-the-middle attempt against MarkLogic outbound connections lacking hostname validation (CVE-2026-85974).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85974
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: syslog
detection:
  selection_event:
    - 'certificate verify failed'
    - 'hostname mismatch'
    - 'SSL peer certificate or SSH remote key was not OK'
    - 'certificate subject name'
  selection_proc:
    - 'MarkLogic'
    - 'marklogic'
    - 'mlserver'
  condition: selection_event and selection_proc
falsepositives:
  - Legitimate misconfigured downstream service certificates
  - Expired certificates on integration endpoints
level: medium

YARA Rule

rule CVE_2026_85974_MarkLogic_TLS_Hostname_Validation
{
    meta:
        description = "Detects MarkLogic Server configuration or packaged components referencing disabled or inconsistent TLS hostname verification, relevant to CVE-2026-85974"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85974"
        date = "2026-01-01"
        severity = "high"
    strings:
        $ml1 = "MarkLogic" ascii wide nocase
        $ver1 = "12.0" ascii wide
        $ver2 = "11.3.6" ascii wide
        $tls1 = "verifyHostname" ascii wide nocase
        $tls2 = "hostnameVerifier" ascii wide nocase
        $tls3 = "trustAllCerts" ascii wide nocase
    condition:
        uint16(0) == 0xCAFE or
        ($ml1 and $tls1) or
        ($ml1 and $tls2) or
        ($ml1 and $tls3) or
        ($ml1 and ($ver1 or $ver2))
}

Suricata IDS Rule

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-85974 Possible MarkLogic Outbound TLS Hostname Mismatch (AiTM)"; flow:established,to_server; tls.store; content:"|16 03|"; depth:2; byte_test:1,=,1,7; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,2026-85974; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85974; classtype:attempted-recon; sid:90085974; rev:1;)

Elastic Detection

tls where event.action == "handshake_failure" and
  process.name in ("java", "MarkLogic", "mlserver") and
  network.direction == "egress" and
  tls.client.server_name != null

Splunk SPL Query

index=marklogic OR index=network
(sourcetype=marklogic:server OR sourcetype=suricata:tls OR sourcetype=zeek:ssl)
("certificate verify failed" OR "hostname mismatch" OR "SSL peer certificate")
| stats count min(_time) as first_seen max(_time) as last_seen values(dest) as destinations by src, user, dest
| where count > 3
| table first_seen, last_seen, src, dest, destinations, count

Wazuh OSSEC Rule

<group name="marklogic,tls,cve-2026-85974,">
  <rule id="100974" level="10">
    <decoded_as>json</decoded_as>
    <field name="program">MarkLogic</field>
    <match>certificate verify failed|hostname mismatch|SSL peer certificate</match>
    <description>CVE-2026-85974: Possible MarkLogic outbound TLS hostname validation failure (AiTM attempt)</description>
    <mitre>
      <id>T1557</id>
    </mitre>
    <group>attack_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source at the time of writing). The NVD description identifies the fixed versions as Progress MarkLogic Server 12.1.0 and 11.3.7, but no vendor advisory URL, hotfix identifier, or patch artifact was supplied in the source data; operators should confirm the availability and integrity of the fixed release through official Progress channels before deployment.

1. Immediate mitigations.

• Restrict outbound TLS traffic from MarkLogic nodes to explicitly allow-listed destinations and pin those connections at the network layer (mTLS, IPsec, or a TLS-inspecting forward proxy that itself enforces hostname verification), reducing the window for a network-positioned AiTM attack.
• Segment MarkLogic cluster and integration traffic onto trusted, monitored network paths; eliminate routing over untrusted or shared segments where feasible.
• Monitor for the detection signals defined above (certificate verification failures, unexpected certificate subjects, anomalous outbound destinations) and treat repeated hostname-mismatch events as suspicious.

2. Patch / upgrade steps.

• Plan an upgrade to MarkLogic Server 12.1.0 (12.x line) or 11.3.7 (11.x line), or a later release in the corresponding line, as identified in the advisory text.
• Verify the affected version of every node in each cluster before upgrading; mixed-version clusters may retain the weakness on unpatched nodes.
• After upgrading, validate that outbound TLS hostname verification is functioning as expected with controlled test connections before returning the cluster to production traffic.

3. Long-term hardening.

• Enforce certificate hostname validation uniformly across all outbound TLS clients, and add regression tests to CI to prevent inconsistent enforcement across code paths.
• Deploy certificate pinning and/or mTLS for server-to-server communications so that possession of any trusted-CA certificate is insufficient to impersonate an endpoint.
• Continuously inventory and monitor all egress TLS flows from MarkLogic nodes, and alert on certificate-subject changes or new external endpoints.
• Track CVE-2026-85974 for vendor updates; because no EPSS score and no KEV listing currently exist, re-evaluate risk as those signals evolve.

References

• NVD — CVE-2026-85974: https://nvd.nist.gov/vuln/detail/CVE-2026-85974
• MITRE CWE-297 — Improper Validation of Certificate with Host Mismatch: https://cwe.mitre.org/data/definitions/297.html
• MITRE ATT&CK T1557 — Adversary-in-the-Middle: https://attack.mitre.org/techniques/T1557/
• FIRST EPSS (CVE-2026-85974 currently unscored): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-85974 not listed as of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template is known for CVE-2026-85974. No CISA KEV listing and no confirmed in-the-wild exploitation or attributed threat actor campaign has been identified at the time of writing.