Progress MarkLogic Server versions prior to 12.1.0 and 11.3.7 do not adequately verify the identity of a Kerberos authentication service when using password‑based authentication configurations. This flaw allows an attacker who can position themselves on the network to impersonate a trusted authentication infrastructure, enabling them to bypass authentication controls and potentially access or modify protected data. The weakness is rooted in CWE‑303, representing an improper verification of an authentication mechanism, which directly undermines confidentiality and integrity.

Affected systems include Progress Software Corporation’s MarkLogic Server. All 12.x releases earlier than12.1.0 and 11.x releases earlier than 11.3.7 are vulnerable. Users of these versions should identify the specific build number and plan an update. No other vendors or products are listed as affected.

The CVSS score of 7.4 indicates a high severity vulnerability, but the EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a network‐positioned attacker capable of intercepting Kerberos traffic. While there is no known public exploit code, the attack requires the ability to present forged Kerberos tickets to the server, which can be achieved by compromising a trusted authenticator or altering the network path to redirect authentication requests. The severity remains high due to the potential for unauthorized data access or modification.