MarkLogic Server CVE-2026-9193

Exploitation requires an authenticated account (PR:L) that has been assigned a low-privileged MarkLogic Hadoop role, and the deployment must have the Hadoop integration enabled/configured - that specific feature IS the required condition. No user interaction is needed and the vector is network-reachable with low complexity. Limiting factors: the attacker cannot be fully anonymous (a valid low-privilege Hadoop credential is required), and environments that do not use the Hadoop integration are not exposed. Affected only on MarkLogic Server versions before 11.3.6 and 12.0.3.

The signals are largely consistent and point to a genuine high priority within affected environments, though tempered by an authentication prerequisite. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) reflects network-reachable, low-complexity exploitation requiring only low privileges, with a scope change because compromise of the Security database transcends the attacker's original authorization boundary. Because the target is the Security database, successful exploitation likely yields full administrative compromise, which justifies the C:H/I:H/A:H triad. Mitigating the raw score: PR:L means an attacker must already hold a valid low-privileged Hadoop account, so this is a privilege-escalation/insider or post-compromise risk rather than a fully anonymous internet-facing RCE. EPSS and SSVC data were not provided, and there is no KEV listing or known POC, suggesting no confirmed widespread exploitation yet - but the trivial complexity and total-compromise impact mean it should be patched urgently wherever the Hadoop integration is enabled.

An attacker who has obtained (or been legitimately assigned) a low-privileged Hadoop connector account authenticates to MarkLogic over the network and invokes the Hadoop integration to issue operations that reach beyond its intended scope, targeting the internal Security database. By manipulating that database the attacker grants themselves administrative roles or alters permissions, taking full control of the server. No public exploit code has been identified, and exploitation requires only a valid low-privilege credential and low attack complexity.