# PostgreSQL critical update addresses 28 vulnerabilities

Published: 2026-08-14 · Severity: routine · Sectors: financial-services, healthcare, government-national, technology, infrastructure
Canonical: https://vorant.io/reports/e072f230-d5c4-574a-b3dc-77381ea2b326/postgresql-critical-update-addresses-28-vulnerabilities

> Multiple critical flaws in PostgreSQL versions 14–18 enable remote code execution, denial of service, and data compromise.

The French CERT has published an advisory covering 28 vulnerabilities across multiple PostgreSQL versions. Affected versions include PostgreSQL 14.x (before 14.24), 15.x (before 15.19), 16.x (before 16.15), 17.x (before 17.11), and 18.x (before 18.6). The vulnerabilities enable remote code execution, remote denial of service, confidentiality breaches through data exfiltration, security policy bypass, and SQL injection attacks. No specific exploitation details are provided in the advisory; defenders should prioritize patching all affected versions immediately to the latest patch release.

The advisory references the PostgreSQL security bulletin of August 13, 2026, which contains the full technical details and patch availability. Organizations running PostgreSQL in production should treat this as urgent and coordinate patching across their estate, starting with systems exposed to untrusted network access.

## Mentioned in this report

- Vulnerabilities: CVE-2026-14662, CVE-2026-14663, CVE-2026-14664, CVE-2026-14666, CVE-2026-14668, CVE-2026-14669, CVE-2026-14670, CVE-2026-14671, CVE-2026-14672, CVE-2026-14673, CVE-2026-14676, CVE-2026-14677, CVE-2026-14678, CVE-2026-14679, CVE-2026-14680, CVE-2026-14681, CVE-2026-15741, CVE-2026-15742, CVE-2026-16238, CVE-2026-16239, CVE-2026-16241, CVE-2026-18024, CVE-2026-18408, CVE-2026-19385, CVE-2026-6464, CVE-2026-6469, CVE-2026-6470, CVE-2026-6471

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1024

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e072f230-d5c4-574a-b3dc-77381ea2b326/postgresql-critical-update-addresses-28-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup