Progress SoftwareCVE-2026-9193

Progress Software MarkLogic Server: privilege escalation

CVE-2026-9193 · Published Aug 5, 2026 · updated Sep 3, 2026

Critical9.9

Fix: upgrade to 11.3.6 or later (2 fixed versions below)

An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database.

Affected versions

Package	Affected	Fixed in
MarkLogic Server Product	>= 11.0.0, < 11.3.6	11.3.6
	>= 12.0.0, < 12.0.3	12.0.3

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-269

More Progress Software advisories

All Progress Software

Critical 9.8Aug 5

Progress Software MarkLogic Server: authentication bypassCVE-2026-9192fixed in 11.3.6 +1 Critical 9.3Aug 5

Progress Software MarkLogic Server: cross-site scriptingCVE-2026-9195fixed in 11.3.6 +1 High 8.5Aug 5

Progress Software MarkLogic Server: server-side request forgeryCVE-2026-9203fixed in 11.3.6 +1 High 8.1Aug 5

Progress Software MarkLogic Server: privilege escalationCVE-2026-7327fixed in 11.3.6 +1 Critical 9.9Aug 5

Progress Software MarkLogic Server: privilege escalationCVE-2026-7329fixed in 11.3.6 +1 Critical 9.1Aug 5

Progress Software MarkLogic Server: authentication bypassCVE-2026-7557fixed in 11.3.6 +1