THREAT OPS › Threat News › [NVD] CVE-2026-9190 (CRITICAL 9.1) — An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs wh
[NVD] CVE-2026-9190 (CRITICAL 9.1) — An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs wh
CVE-2026-9190 CVSS: 9.1 CRITICAL Published: 2026-08-05T16:17:09.940
An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-L
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-9190cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-9190