MarkLogic Server CVE-2026-9192

The MarkLogic ODBC App Server must be enabled and network-reachable by the attacker - that specific component is the vulnerable surface, not the core HTTP/XDBC app servers. Given AV:N/AC:L/PR:N/UI:N, exploitation is remote and unauthenticated against affected versions (before 11.3.6 / 12.0.3) once the ODBC listener is reachable, with no user interaction or valid credentials needed. The attacker must know or guess a valid named username to impersonate (e.g., a default or admin account name), which is a low bar. Limiting factors: deployments that do not run the ODBC App Server, or that firewall its port to trusted hosts only, are not exposed; patched versions close the bypass entirely.

All signals point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) indicates a network-reachable, low-complexity attack requiring no privileges and no user interaction, with high impact to confidentiality, integrity, and availability - consistent with the description of unauthenticated remote impersonation of any user. The description and CVSS agree cleanly (network vector matches the remotely-exposed ODBC App Server), so there is no conflict to flag. No EPSS score, KEV listing, POC, or SSVC decision data was supplied in the input, so exploitation-in-the-wild probability cannot be quantified and there is no public exploit identified at time of analysis. The mitigating factor is exposure scope: exploitation depends on the ODBC App Server being enabled and network-reachable, which is not universal across MarkLogic deployments. Where that listener is exposed, however, the effective risk is critical because a bypass yields administrator-equivalent database access. Absent EPSS/KEV data, treat this as a high-priority patch based on the authenticated impact and trivial exploit complexity rather than confirmed active exploitation.

An attacker who can reach the MarkLogic ODBC App Server port over the network connects with a PostgreSQL/ODBC client, supplies the username of a known administrator account, and bypasses password verification to authenticate as that admin. With administrator privileges the attacker then runs SQL/queries to read sensitive data, modify or delete records, or alter server configuration. No public exploit is identified at time of analysis, and the CVSS AC:L/PR:N/UI:N vector means the attack is low-complexity and requires no prior credentials or user interaction.