CVE-2026-9192

{
  "id": "CVE-2026-9192",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-05T16:17:10.063",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de omisión de autenticación en el ODBC App Server de Progress MarkLogic Server anterior a 11.3.6 y 12.0.3 permite a un atacante remoto no autenticado omitir la verificación de contraseña y ejecutar consultas con los privilegios de cualquier usuario nombrado conocido por el servidor, incluidos los administradores."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Progress Software Corporation",
          "product": "MarkLogic Server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "11.0.0",
              "lessThan": "11.3.6",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "12.0.0",
              "lessThan": "12.0.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-06T00:00:00+00:00",
          "id": "CVE-2026-9192",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:progress:marklogic_server:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "11.3.6",
              "matchCriteriaId": "10D63D90-CD8D-4F3F-A211-2E954FC03F62"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:progress:marklogic_server:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "12.0.0",
              "versionEndExcluding": "12.0.3",
              "matchCriteriaId": "8345B0B6-9047-4E43-B89B-01FFB56CB733"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}