This vulnerability (CVE-2026-9193) in Progress Software Corporation's MarkLogic Server involves improper privilege management within the Hadoop integration component. Specifically, authenticated users assigned a low-privileged Hadoop role can escalate their privileges to execute privileged operations against the Security database, potentially compromising the system's security controls. The flaw affects versions 11.0.0 and 12.0.0 of MarkLogic Server. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

An attacker with low-privileged Hadoop role authentication can escalate privileges to perform sensitive operations on the Security database, potentially leading to full compromise of security controls, data confidentiality, integrity, and availability within the affected MarkLogic Server instances.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor Progress Software Corporation advisories for updates and consider restricting access to Hadoop roles until a patch is available.