{"id":"CVE-2026-9193","state":"PUBLISHED","title":"Privilege escalation in Progress MarkLogic Server Hadoop integration","description":"An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database.","publishedAt":"2026-08-05T15:37:07.686Z","updatedAt":"2026-08-07T03:55:32.271Z","severity":{"score":9.9,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"ProgressSoftware"},"assigner":"ProgressSoftware","products":["Progress Software Corporation MarkLogic Server"],"affected":[{"vendor":"Progress Software Corporation","product":"MarkLogic Server","defaultStatus":"unaffected","versions":[{"version":"11.0.0","status":"affected","lessThan":"11.3.6","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.3","versionType":"custom"}]}],"references":["https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026"],"weaknesses":["CWE-269"],"ingestedAt":"2026-10-29T20:13:52.441Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/9xxx/CVE-2026-9193.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-9193","state":"PUBLISHED","datePublished":"2026-08-05T15:37:07.686Z","dateUpdated":"2026-08-07T03:55:32.271Z","assignerShortName":"ProgressSoftware","assignerOrgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","dateReserved":"2026-05-21T15:19:27.735Z"},"containers":{"cna":{"title":"Privilege escalation in Progress MarkLogic Server Hadoop integration","descriptions":[{"lang":"en","value":"An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database."}],"affected":[{"vendor":"Progress Software Corporation","product":"MarkLogic Server","defaultStatus":"unaffected","versions":[{"version":"11.0.0","status":"affected","lessThan":"11.3.6","versionType":"custom"},{"version":"12.0.0","status":"affected","lessThan":"12.0.3","versionType":"custom"}]}],"references":[{"url":"https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.9,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","lang":"en","description":"CWE-269: Improper Privilege Management","type":"CWE"}]}],"providerMetadata":{"shortName":"ProgressSoftware","orgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","dateUpdated":"2026-08-05T15:37:07.686Z"},"workarounds":[{"lang":"en","value":"Restrict Hadoop integration privileges to users who require MLCP or Hadoop integration. Restrict network access to XDBC App Servers used for MLCP operations to trusted hosts. Disable XDBC App Servers used for MLCP if they are not required.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Restrict Hadoop integration privileges to users who require MLCP or Hadoop integration. Restrict network access to XDBC App Servers used for MLCP operations to trusted hosts. Disable XDBC App Servers used for MLCP if they are not required.</p>"}]}],"credits":[{"lang":"en","value":"rexnets via Bugcrowd","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-06T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-9193"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-07T03:55:32.271Z"}}]}}}