CVE-2026-85974

{
  "etk_id": "ETK-2026-1414",
  "cve_id": "CVE-2026-85974",
  "display_id": "CVE-2026-85974",
  "ghsa_id": "GHSA-6q89-c966-c783",
  "euvd_id": "EUVD-2026-97571",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper TLS hostname verification in MarkLogic Server",
  "summary": "MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 may fail to verify TLS certificate hostnames for certain outbound connections. An attacker able to interfere with network traffic could intercept or alter communications involving an affected service.",
  "mitigation": "Upgrade MarkLogic Server 11.x to 11.3.7 or later, or 12.x to 12.1.0 or later. Until upgraded, reduce exposure by limiting untrusted network paths to outbound services.",
  "vendor": "Progress Software Corporation",
  "product": "MarkLogic Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 11.0.0, < 11.3.7",
        ">= 12.0.0, < 12.1.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "11.3.7",
        "12.1.0"
      ],
      "package_name": "MarkLogic Server",
      "purl": null
    }
  ],
  "cwes": [
    297
  ],
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0014,
  "epss_percentile": 0.0289,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 72.69249066666667,
  "t0_at": "2026-10-12T16:50:49.589000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T16:50:49.589000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T16:50:49.589000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85974"
    }
  }
}