Critical severity9.8NVD Advisory· Published Aug 5, 2026· Updated Oct 23, 2026
CVE-2026-9192
CVE-2026-9192
Description
An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators.
Affected products
3cpe:2.3:a:progress:marklogic_server:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:progress:marklogic_server:*:*:*:*:*:*:*:*range: <11.3.6
- (no CPE)range: <11.3.6, <12.0.3
- Range: <11.3.6, <12.0.3
Patches
Vulnerability mechanics
References
1News mentions
2- ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and MoreThe Hacker News · Oct 19, 2026
- Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin ControlThe Hacker News · Oct 13, 2026