CVE-2026-9192 Progress Software Corporation CVE debrief

Who should care

Progress MarkLogic Server administrators and users, cybersecurity teams, operators, and security teams should be aware of the authentication bypass vulnerability and take necessary actions to prevent potential attacks. This includes verifying system configurations, applying patches, and monitoring for suspicious activity. Affected product deployments should be identified, and owners assigned for follow-up.

Technical summary

CVE-2026-9192 is an authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3. An unauthenticated remote attacker can bypass password verification and execute queries with the privileges of any named user known to the server. The vulnerability allows attackers to execute queries with the privileges of any named user known to the server, including administrators. The CVSS score of 9.8 indicates a high severity vulnerability that requires immediate attention.

Defensive priority

Organizations using Progress MarkLogic Server should prioritize patching to prevent potential authentication bypass attacks.

Recommended defensive actions

• Apply patches for Progress MarkLogic Server versions before 11.3.6 and 12.0.3
• Verify and update affected systems
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the authentication bypass vulnerability in Progress MarkLogic Server. Verification of affected versions and patching is necessary. Affected product deployments should be identified, and owners assigned for follow-up. The vulnerability allows unauthenticated remote attackers to bypass password verification and execute queries with the privileges of any named user known to the server. Defensive priorities include verifying system configurations, monitoring for suspicious activity, and applying patches for Progress MarkLogic Server versions before 11.3.6 and 12.0.3.

Official resources