CVE-2026-85975

Executive Summary

CVE-2026-85975 is a cleartext-transmission vulnerability (CWE-319) in Progress MarkLogic Server, affecting 12.x releases before 12.1.0 and 11.x releases before 11.3.7. By default, affected versions may establish Amazon S3 connections over cleartext transport rather than TLS, exposing transmitted data and credentials to a network-positioned attacker. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), driven by high confidentiality impact with no authentication or user interaction required, though the attack depends on the adversary achieving a man-in-the-middle network position.

Technical Analysis

The root cause is a failure to enforce encrypted transport for outbound S3 connections. Progress MarkLogic Server integrates with Amazon S3 — commonly as a storage tier for backups, journal archiving, tiered storage, or data movement workflows. Per the NVD description, affected versions "may use cleartext transport for Amazon S3 connections by default." This places the flaw squarely in CWE-319: Cleartext Transmission of Sensitive Information.

The exposure is configuration- and default-driven rather than a memory-safety or injection class. The relevant attack surface is not the MarkLogic HTTP/REST service interfaces but the outbound client channel between the MarkLogic node and the Amazon S3 endpoint. When that channel is cleartext:

• Application-layer payloads (objects, backup data, journal data) traverse the wire unencrypted.
• Any authentication material transmitted as part of the S3 session — specifically AWS access/secret key material or session tokens exposed in signing flows — is also subject to interception.
• Integrity is not a scored impact: the CVSS vector lists I:N, meaning the flaw is scored as a confidentiality-only issue. No availability (A:N) or integrity (I:N) impact is asserted.

CVSS v3.1 vector breakdown (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N):

• AV:N (Network): the attacker needs network reachability along the path between the MarkLogic node and S3, consistent with a network-positioned adversary.
• AC:L (Low): no special conditions beyond the attacker being positioned to intercept the cleartext flow.
• PR:N / UI:N: no privileges and no user interaction are required.
• S:U (Unchanged): exploitation does not cross a security authority boundary.
• C:H (High): full confidentiality loss of transmitted data and credentials within the affected connection.
• I:N / A:N: no integrity or availability impact is scored.

Because the flaw is a transport-security default rather than a discrete code defect with an injectable input, there is no single request parameter or endpoint that triggers it. No public PoC, Nuclei template, or exploit code has been observed for this CVE. Any attack chain must therefore be reasoned at the vulnerability-class level rather than from public exploit artifacts. Insufficient technical detail is available in the supplied NVD description to attribute specific code elements, configuration keys, or API parameters; none should be assumed.

Exploitation Scenarios

Note: No public PoC available; the attack chain below is inferred from the vulnerability class (CWE-319, cleartext transport), not from published exploit code.

1. Reconnaissance / target identification: An attacker first establishes that a target organization runs MarkLogic Server within the affected version windows (12.x < 12.1.0, 11.x < 11.3.7). Because the vulnerable channel is outbound to S3 rather than inbound to a listening service, target acquisition typically depends on the attacker already possessing a position on the network path — for example, a misconfigured or hostile cloud network segment, a compromised host on the same subnet, an attacker-in-the-middle on a VPN or transit link, or a rogue network device between the MarkLogic deployment and the S3 endpoint. Passive fingerprinting of MarkLogic management or HTTP ports via internet-facing exposure can help identify candidate deployments but does not by itself confirm cleartext S3 egress.

2. Triggering the flaw class: No injection, malformed input, or crafted request is required. If the affected MarkLogic release is using the default cleartext S3 transport, ordinary configured integrations — backups, journalling, tiered storage, or S3-backed operations — will emit S3 traffic in the clear. The attacker simply captures that traffic on the path. The "trigger" is therefore normal operation under insecure default configuration, not an adversarial payload.

3. Interception / execution method: The attacker performs passive or active interception of the S3-bound stream — for example, packet capture on a shared segment, ARP or DNS manipulation to reroute traffic, or control of an intermediate network hop. Because the transport is cleartext, no cryptographic break is needed. Recoverable content includes: object/data payloads in transit and any credentials or tokens carried in the session. The precise set of fields transmitted in the clear is not documented in the supplied data and should not be over-specified.

4. Post-exploitation impact: Stolen S3 credentials, if present in the intercepted session, can be reused outside the MarkLogic context to access or exfiltrate S3 bucket contents, and stolen data payloads may contain sensitive backup or application content. The scope is bounded by the confidentiality of the intercepted connection: no integrity or availability impact is scored under the CVSS vector, and there is no evidence that the attacker gains code execution on the MarkLogic node through this flaw. Impact thus concentrates on credential compromise, data disclosure, and downstream lateral movement into cloud storage.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High) with subscores C:H/I:N/A:N. The business impact is dominated by confidentiality: interception of cleartext S3 traffic can expose both transported data and cloud credentials. Credential compromise elevates blast radius well beyond the MarkLogic deployment itself, since recovered S3 credentials may grant access to backup buckets, journal archives, or tiered-storage repositories holding regulated or business-critical data. Affected systems are MarkLogic Server deployments on 12.x releases before 12.1.0 and 11.x releases before 11.3.7 that rely on default S3 transport settings. The exploitation precondition — a network-positioned attacker — limits mass opportunistic exploitation but raises the risk for multi-tenant cloud networks, shared VPCs, hybrid/VPN topologies, and any environment where the S3 egress path is not fully trusted. Because exploitation requires no credentials, no user interaction, and no special complexity (PR:N, UI:N, AC:L), any attacker who attains the required network vantage point can exploit the issue. No CISA KEV listing and no known in-the-wild exploitation were reported in the supplied data.

Detection Guidance

Detection centers on identifying cleartext S3-bound traffic from a MarkLogic node and on configuration drift away from enforced TLS. Because there is no request-level signature, detection is best framed as cleartext-egress detection plus configuration monitoring.

Sigma Rule

title: MarkLogic Server Cleartext S3 Egress Configuration (CVE-2026-85975)
id: 8f3c2a10-5b7e-4d21-9c44-1a2b3c4d5e6f
status: experimental
description: Detects configuration or process telemetry indicating MarkLogic Server may use cleartext transport for Amazon S3 connections.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85975
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_proc:
    Image|endswith: 'marklogic'
  selection_cfg:
    CommandLine|contains:
      - 's3'
      - 'S3'
  condition: selection_proc and selection_cfg
fields:
  - CommandLine
  - Image
falsepositives:
  - Legitimate administrative operations referencing S3
level: medium
tags:
  - attack.t1040
  - cve.2026.85975

YARA Rule

rule CVE_2026_85975_MarkLogic_Cleartext_S3
{
    meta:
        description = "Detects MarkLogic configuration references to cleartext S3 transport (CVE-2026-85975)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85975"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s3a = "s3://" ascii wide nocase
        $s3b = "amazonaws.com" ascii wide nocase
        $ml1 = "MarkLogic" ascii wide nocase
        $ml2 = "marklogic" ascii wide nocase
        $clear = "cleartext" ascii wide nocase
    condition:
        (uint16(0) == 0x3C3F or uint32(0) == 0x786D6C3C) and
        (any of ($ml1, $ml2)) and (any of ($s3a, $s3b)) and $clear
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"CVE-2026-85975 MarkLogic cleartext Amazon S3 connection attempted"; flow:to_server,established; content:"Host|3a 20|"; nocase; content:"s3"; distance:0; nocase; content:"amazonaws.com"; nocase; distance:0; reference:cve,2026-85975; classtype:policy-violation; sid:202685975; rev:1; metadata:affected_product MarkLogic_Server, cve CVE-2026-85975;)

Elastic Detection

process where event.type == "start" and process.name like "~marklogic*" and process.command_line like "*s3*" and not process.command_line like "~*https*"

Splunk SPL Query

index=marklogic OR index=os sourcetype IN (marklogic:log, linux:audit)
(("s3" OR "S3") AND ("cleartext" OR "http://" OR "amazonaws.com"))
| stats count min(_time) as first_seen max(_time) as last_seen by host, sourcetype, source
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="marklogic,cve-2026-85975,">
  <rule id="100975" level="10">
    <decoded_as>json</decoded_as>
    <field name="event">cleartext.*s3</field>
    <description>CVE-2026-85975: MarkLogic Server may use cleartext transport for Amazon S3 connections</description>
    <mitre>
      <id>T1040</id>
    </mitre>
    <group>cve_2026_85975,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Enforce TLS for all Amazon S3 connectivity from MarkLogic. Configure S3 connections to use HTTPS endpoints and reject plaintext S3 endpoints at the network layer. Because the supplied data does not document the specific configuration interface, administrators must consult MarkLogic documentation for their version to disable cleartext S3 transport.
• Block outbound TCP/80 to S3 endpoints via egress firewall or security-group policy, allowing only TCP/443. This forces TLS use and neutralizes the cleartext path.
• Segment the MarkLogic-to-S3 path so it traverses only trusted, encrypted links (private connectivity/TLS-terminated paths), reducing the attacker's ability to reach the cleartext flow.
• Rotate any AWS access keys, secret keys, and session tokens associated with S3 integrations, on the assumption that cleartext sessions may already have existed.
• Monitor for and alert on anomalous S3 API activity using suspected keys.

2. Patch/upgrade steps:

• Per NVD, the affected ranges are 12.x before 12.1.0 and 11.x before 11.3.7. Upgrade to 12.1.0 or later on the 12.x line, and to 11.3.7 or later on the 11.x line. No vendor advisory, commit, or patch artifact was present in the supplied intelligence feed, so verify these target versions against Progress's official advisories before scheduling change windows.
• Because no patch evidence was confirmed by any tracked source, treat all target versions as needing verification and validate that the upgrade actually enforces TLS for S3 before closing the finding.

3. Long-term hardening:

• Enforce TLS everywhere by policy: mandate HTTPS endpoints for all object storage and internal service communications, and codify this in deployment templates and infrastructure-as-code so defaults cannot regress.
• Adopt configuration baselines that require encrypted transport, and add continuous configuration monitoring (the Sigma/Wazuh detections above) to catch cleartext S3 usage.
• Deploy egress controls so that cleartext protocols to cloud storage are blocked by default (deny-by-default egress).
• Shorten credential lifetimes and prefer short-lived, scoped credentials (e.g., role-based, temporary tokens) to reduce the value of any intercepted material.

References

• NVD — CVE-2026-85975: https://nvd.nist.gov/vuln/detail/CVE-2026-85975
• MITRE CWE-319 — Cleartext Transmission of Sensitive Information: https://cwe.mitre.org/data/definitions/319.html
• MITRE ATT&CK T1040 — Network Sniffing: https://attack.mitre.org/techniques/T1040/
• Progress MarkLogic Server product/security advisories (vendor site — verify advisory for 12.1.0 / 11.3.7 remediation): https://www.progress.com/marklogic
• CISA Known Exploited Vulnerabilities catalog (check for additions): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaign or exploit-in-the-wild evidence was present in the supplied data. No CISA KEV listing exists for this CVE as of the data provided.