PostgreSQL critical update addresses 28 vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple critical flaws in PostgreSQL versions 14–18 enable remote code execution, denial of service, and data compromise.
The French CERT has published an advisory covering 28 vulnerabilities across multiple PostgreSQL versions. Affected versions include PostgreSQL 14.x (before 14.24), 15.x (before 15.19), 16.x (before 16.15), 17.x (before 17.11), and 18.x (before 18.6). The vulnerabilities enable remote code execution, remote denial of service, confidentiality breaches through data exfiltration, security policy bypass, and SQL injection attacks. No specific exploitation details are provided in the advisory; defenders should prioritize patching all affected versions immediately to the latest patch release.
The advisory references the PostgreSQL security bulletin of August 13, 2026, which contains the full technical details and patch availability. Organizations running PostgreSQL in production should treat this as urgent and coordinate patching across their estate, starting with systems exposed to untrusted network access.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1024
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs