CVE-2026-9193
Received Received - Intake

Improper Privilege Escalation in MarkLogic Server

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Progress Software Corporation

Description
An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-9193
EUVD
EUVD-2026-53429

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
progress marklogic_server to 12.0.3 (exc)
progress marklogic_server 12.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper privilege management issue in Progress MarkLogic Server's Hadoop integration. It allows an authenticated user with low privileges to escalate their access and perform privileged operations against the Security database.

Detection Guidance

Detecting this vulnerability requires checking the MarkLogic Server version and Hadoop integration configuration. Verify if the server version is before 11.3.6 or 12.0.3. Inspect Hadoop roles for improper privilege assignments.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data, modify security settings, or perform actions requiring higher privileges, potentially leading to data breaches or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance risks include legal penalties, fines, and reputational damage.

Mitigation Strategies

Upgrade MarkLogic Server to version 11.3.6 or 12.0.3 or later. Review and correct Hadoop role privileges to prevent privilege escalation. Restrict access to low-privileged users until patches are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9193. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart