External risk intelligence

Progress MarkLogic Server ODBC Authentication Bypass Leads to Privileged Query Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-9192

The vulnerability affects an ODBC App Server interface. While this protocol is typically used for internal application connectivity and database communication, it is occasionally exposed to the internet in specific, non-standard deployment architectures, making remote reachability possible but not the standard or intended configuration for this product.

Authentication Bypass

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An authentication bypass vulnerability has been identified in the ODBC App Server component of Progress MarkLogic Server. This issue could permit unauthenticated remote attackers to bypass password checks and gain the privileges of any user on the server, including administrators. The main concern is to confirm if this specific technology is deployed and exposed within the organization's environment.

Bypasses user passwords for server access.
Important for understanding potential access control risks.
Verify if this specific server component is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by remotely sending specially crafted requests to the vulnerable ODBC App Server. This bypasses the normal password check, allowing the attacker to impersonate any user on the server, including administrators, and run arbitrary queries.

Unauthenticated remote access required.
Bypasses password verification.
Allows arbitrary query execution.

Live Threat

Current exploitation, exposure, and threat context

An authentication bypass vulnerability in the ODBC App Server could allow an unauthenticated remote attacker to execute queries with the privileges of any user, including administrators. This is possible when the ODBC App Server is exposed externally.

User privilege escalation.
Unauthenticated remote query execution.
Unauthorized access to sensitive data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Progress MarkLogic Server ODBC App Server is likely managed by a platform or infrastructure team, with application owners accountable for their specific deployments. The immediate first step is to discover all instances of the affected MarkLogic Server, determine their external reachability and criticality, and identify the responsible owner for each. Planning remediation should then prioritize the most exposed or critical systems.

Platform or infrastructure teams should own this.
Verify external reachability and criticality.
Plan remediation based on asset risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress MarkLogic Server?

Progress MarkLogic Server is a multi-model database platform designed to store, manage, and query complex data. The affected component, the ODBC App Server, acts as a gateway that allows external applications to connect to the database using the Open Database Connectivity standard. This interface is typically used to bridge the gap between reporting tools or custom applications and the core database, enabling seamless data retrieval and manipulation.

What does CVE-2026-9192 mean for authentication?

This vulnerability is classified as CWE-287, or Improper Authentication. In plain English, it means the system's identity-checking mechanism is flawed. Specifically, the ODBC App Server fails to properly verify credentials, allowing a remote user to skip the password requirement entirely and interact with the database as if they were a logged-in user, including an administrator.

How does an attacker trigger this bypass?

An attacker triggers this by sending specially crafted requests to the ODBC App Server port. The vulnerability does not require the attacker to know any valid usernames or passwords. It is important to note that internal database queries that do not pass through the vulnerable ODBC App Server interface are not susceptible to this specific authentication bypass path.

Is my instance of MarkLogic Server at risk?

Halo Surface Signal indicates that while the ODBC App Server is primarily intended for internal application connectivity, it may be reachable if configured in non-standard ways. If your server is exposed to the internet, it is at higher risk for unauthorized access. You should evaluate your network architecture to confirm if this specific interface is accessible outside of your internal environment.

What should I do if I run this technology?

Your first step is to locate all instances of MarkLogic Server within your environment and identify the teams responsible for managing them. Prioritize systems that are reachable over the network. Work with your infrastructure team to verify if the ODBC App Server component is active and confirm its exposure level to determine the immediate risk to your data and administrative access.

References

community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.