Skip to content
Threat Feed
Subscribe
high advisory

Multiple Vulnerabilities in PostgreSQL

PostgreSQL has released patches for multiple high-severity vulnerabilities across several versions that could allow remote attackers to achieve arbitrary code execution, perform SQL injection, or conduct denial-of-service attacks.

CVE search metadata

CVE search record: CVE-2026-14669. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL 14, PostgreSQL 15, PostgreSQL 16, PostgreSQL 17, PostgreSQL 18, PostgreSQL. Brief: Multiple Vulnerabilities in PostgreSQL. Brief link: https://feed.craftedsignal.io/briefs/2026-08-postgresql-vulns/

CVE search record: CVE-2026-14671. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL 14, PostgreSQL 15, PostgreSQL 16, PostgreSQL 17, PostgreSQL 18, PostgreSQL. Brief: Multiple Vulnerabilities in PostgreSQL. Brief link: https://feed.craftedsignal.io/briefs/2026-08-postgresql-vulns/

CVE search record: CVE-2026-14673. Severity: low. CVSS: 3.8. KEV: no. Product: PostgreSQL 14, PostgreSQL 15, PostgreSQL 16, PostgreSQL 17, PostgreSQL 18, PostgreSQL. Brief: Multiple Vulnerabilities in PostgreSQL. Brief link: https://feed.craftedsignal.io/briefs/2026-08-postgresql-vulns/

CVE search record: CVE-2026-14676. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL 14, PostgreSQL 15, PostgreSQL 16, PostgreSQL 17, PostgreSQL 18, PostgreSQL. Brief: Multiple Vulnerabilities in PostgreSQL. Brief link: https://feed.craftedsignal.io/briefs/2026-08-postgresql-vulns/

CVE search record: CVE-2026-14680. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL 14, PostgreSQL 15, PostgreSQL 16, PostgreSQL 17, PostgreSQL 18, PostgreSQL. Brief: Multiple Vulnerabilities in PostgreSQL. Brief link: https://feed.craftedsignal.io/briefs/2026-08-postgresql-vulns/

CVE search record: CVE-2026-14678. Severity: medium. CVSS: 4.3. KEV: no. Product: PostgreSQL 14, PostgreSQL 15, PostgreSQL 16, PostgreSQL 17, PostgreSQL 18, PostgreSQL. Brief: Multiple Vulnerabilities in PostgreSQL. Brief link: https://feed.craftedsignal.io/briefs/2026-08-postgresql-vulns/

CVE search record: CVE-2026-14679. Severity: high. CVSS: 8.2. KEV: no. Product: PostgreSQL 14, PostgreSQL 15, PostgreSQL 16, PostgreSQL 17, PostgreSQL 18, PostgreSQL. Brief: Multiple Vulnerabilities in PostgreSQL. Brief link: https://feed.craftedsignal.io/briefs/2026-08-postgresql-vulns/

CVE search record: CVE-2026-14681. Severity: medium. CVSS: 4.2. KEV: no. Product: PostgreSQL 14, PostgreSQL 15, PostgreSQL 16, PostgreSQL 17, PostgreSQL 18, PostgreSQL. Brief: Multiple Vulnerabilities in PostgreSQL. Brief link: https://feed.craftedsignal.io/briefs/2026-08-postgresql-vulns/

CVE search record: CVE-2026-16238. Severity: high. CVSS: 8.8. KEV: no. Product: PostgreSQL 14, PostgreSQL 15, PostgreSQL 16, PostgreSQL 17, PostgreSQL 18, PostgreSQL. Brief: Multiple Vulnerabilities in PostgreSQL. Brief link: https://feed.craftedsignal.io/briefs/2026-08-postgresql-vulns/

What's new

  • 1. added CVE-2026-14678 +3 Aug 14, 14:06 via bsi

On August 13, 2026, the PostgreSQL Global Development Group released updates addressing a significant number of vulnerabilities affecting multiple versions of the database management system. These vulnerabilities, tracked under various CVE identifiers, range in impact from SQL injection and data confidentiality breaches to remote code execution (RCE) and denial-of-service (DoS) conditions. The affected software branches include versions 14, 15, 16, 17, and 18. Given the critical nature of database infrastructure and the potential for unauthorized code execution or data exfiltration, administrators are urged to verify their current PostgreSQL version and apply the vendor-provided patches immediately. This update cycle serves as a critical maintenance release to remediate security flaws discovered during routine auditing and vulnerability assessment processes.

Impact

Successful exploitation of these vulnerabilities could lead to total database compromise, including the exfiltration of sensitive information, the execution of arbitrary commands with the privileges of the database service, or the disruption of critical business operations through service instability. Organizations failing to patch these systems remain vulnerable to unauthenticated or authenticated attackers depending on the specific CVE being leveraged, potentially leading to unauthorized system access or loss of data integrity.

Recommendation

  • Immediately inventory all PostgreSQL database instances and identify versions falling within the vulnerable ranges (prior to 14.24, 15.19, 16.15, 17.11, and 18.6).
  • Upgrade all identified instances to the latest patched releases provided by the PostgreSQL project.
  • Review database access logs for unusual queries or unauthorized connection attempts, particularly those targeting system-level configuration or internal function calls, as these may indicate attempted exploitation of SQL injection or RCE flaws.
  • Ensure database services are running with the principle of least privilege, minimizing the potential impact should an attacker gain code execution.

Immediate actions

Patch all PostgreSQL instances to current safe versions

IT Operations 48h

Mitigations

Upgrade PostgreSQL versions

immediate IT Operations

All CVEs listed in brief