EUVD-2026-53427
GHSA-j99j-whfx-75gq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote ODBC listener, no auth or interaction needed (AV:N/AC:L/PR:N/UI:N); admin impersonation yields full C/I/A impact; no cross-system scope change.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators.
AnalysisAI
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker circumvent password verification and run queries as any named user, including administrators. Because impersonation extends to admin-level accounts, an attacker gains full read/write control over the database and its data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The MarkLogic ODBC App Server must be enabled and network-reachable by the attacker - that specific component is the vulnerable surface, not the core HTTP/XDBC app servers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the MarkLogic ODBC App Server port over the network connects with a PostgreSQL/ODBC client, supplies the username of a known administrator account, and bypasses password verification to authenticate as that admin. With administrator privileges the attacker then runs SQL/queries to read sensitive data, modify or delete records, or alter server configuration. … |
| Remediation | Upgrade to a fixed release: MarkLogic Server 11.3.6 for the 11.x branch or 12.0.3 for the 12.x branch, as identified in the Progress MarkLogic Critical Security Alert Bulletin (August 2026) at https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026 (Vendor-released patch: 11.3.6 / 12.0.3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all MarkLogic Server deployments and identify instances running versions prior to 11.3.6 (9.x-11.x) or 12.0.2; immediately restrict ODBC inbound access (default port 1433/TCP) at the network perimeter to whitelisted authorized endpoints only, or disable ODBC entirely if not operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Marklogic Server
View allPrivilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a l
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote at
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged u
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user h
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote, unauthenticated attacker to trigge
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today