This vulnerability (CVE-2026-9192) in Progress MarkLogic Server's ODBC App Server allows an unauthenticated remote attacker to bypass authentication controls. Specifically, the attacker can execute queries with the privileges of any known user on the server, including administrative accounts. The affected versions explicitly include 11.0.0 and 12.0.0. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker exploiting this vulnerability can gain unauthorized access to the MarkLogic Server by bypassing password verification. This enables execution of arbitrary queries with the privileges of any named user, including administrators, potentially leading to full compromise of the database server and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented in the provided data. Users should monitor Progress Software Corporation advisories for updates and apply patches once available.