The vulnerability arises from the server not correctly verifying the hostname presented in a TLS certificate for specific outbound connections. This lack of validation lets an attacker replace or manipulate the secure channel, effectively permitting a man‑in‑the‑middle attack. The weakness is a classic Improper Validation of TLS/SSL Certificate scenario (CWE-297). As a result, an adversary can gain confidential information or alter data transmitted to a trusted service.

Affected products include Progress Software Corporation’s MarkLogic Server. Versions earlier than 12.1.0 of the 12.x line and earlier than 11.3.7 of the 11.x line are susceptible. No other affected versions are listed.

The base CVSS score of 7.4 indicates a high severity level. Because the exploit requires a network-positioned attacker to intercept the outbound traffic, the attack vector is classified as network. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, with sufficient access to the network path between the MarkLogic instance and its external peers, an attacker could employ the flaw to intercept or modify TLS traffic. No local privilege escalation is necessary, so the impact is limited to accounts that can reach the affected system.