by Kastro
Paper/Archive/CVE-2026-9192

CVE-2026-9192

Progress Software Corporation MarkLogic Server — Authentication bypass in Progress MarkLogic Server ODBC App Server

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.7.577 × 2011.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators.

Affected

ProductAffectedFixed inSource
MarkLogic Server11.0.0 – < 11.3.611.3.6CNA
MarkLogic Server12.0.0 – < 12.0.312.0.3CNA

Scores by source

ProgressSoftware (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorycommunity.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026