An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with…

A critical improper privilege management vulnerability (CVE-2026-9193) has been identified in the Hadoop integration component of Progress MarkLogic Server. The flaw affects versions prior to 11.3.6 and 12.0.3. An authenticated user holding a low-privileged Hadoop role can exploit this vulnerability to escalate their privileges within the system. Once escalated, the attacker can execute privileged operations directly against the Security database, potentially compromising sensitive security configurations and data. The vulnerability requires authentication, limiting unauthenticated exploitation, but poses a significant risk to environments where MarkLogic's Hadoop integration is in use. Progress has released patched versions 11.3.6 and 12.0.3 to remediate the issue. Organizations using affected versions are strongly advised to upgrade immediately. The issue was disclosed via a Progress community security alert bulletin in August 2026.