CVE-2026-9192: marklogic server before 11.3.6 (exclusive), from 12.0.0 (inclusive), before 12.0.3 (exclusive); +1 more affected…

Affected technology

marklogic server · before 11.3.6 (exclusive)
progress

marklogic server · from 12.0.0 (inclusive), before 12.0.3 (exclusive)
progress

MarkLogic Server · 11.0.0 to before 11.3.6, 12.0.0 to before 12.0.3
Progress Software Corporation

Description’s affected range: before 11.3.6 and 12.0.3

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can bypass password verification and execute queries with the privileges of any named user known to the server, including administrators. Vendor/CNA’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.