EUVD-2026-53429
GHSA-3668-6qq4-jvg8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable with a valid low-privilege Hadoop account (PR:L), low complexity, and scope change (S:C) because compromising the Security database exceeds the role's authority, yielding full C/I/A impact.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database.
AnalysisAI
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding only a low-privileged Hadoop integration role break out of that role and perform privileged operations against the internal Security database, effectively enabling full control over authentication and authorization data. Rated CVSS 9.9 with a changed scope, the flaw turns a minimal Hadoop-connector account into an administrative foothold. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account (PR:L) that has been assigned a low-privileged MarkLogic Hadoop role, and the deployment must have the Hadoop integration enabled/configured - that specific feature IS the required condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent and point to a genuine high priority within affected environments, though tempered by an authentication prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained (or been legitimately assigned) a low-privileged Hadoop connector account authenticates to MarkLogic over the network and invokes the Hadoop integration to issue operations that reach beyond its intended scope, targeting the internal Security database. By manipulating that database the attacker grants themselves administrative roles or alters permissions, taking full control of the server. … |
| Remediation | Vendor-released patch: upgrade to MarkLogic Server 11.3.6 or 12.0.3 (or later) per the Progress August 2026 Critical Security Alert Bulletin at https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Progress MarkLogic Server deployments and document current versions; immediately restrict Hadoop integration role assignments to only essential trusted accounts; review recent access logs for any Hadoop role activity or privilege escalation attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Marklogic Server
View allPrivilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a l
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthentic
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote at
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged u
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user h
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote, unauthenticated attacker to trigge
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today