> TritonInfoSec News
Home / Sep 05, 2026 / Story
0
#3 SecurityWeek general September 04, 2026 at 12:06 UTC

12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover

By Ionut Arghire

AI Summary

CVE-2026-6471, dubbed PostGREShell, is a 12-year-old logical decoding flaw in PostgreSQL present since version 9.4 (2014) that allows an account with the REPLICATION attribute to execute arbitrary code as the OS user running the database. Affected versions include all PostgreSQL releases before 18.6, 17.11, 16.15, 15.19, and 14.24, meaning unpatched deployments face risks of database takeover and persistent backdoor installation.

Read full article → https://www.securityweek.com/12-year-old-postgresq…

Relevance score: 86.0/100

# More from September 05

  1. 1
    Critical Citrix NetScaler auth bypass now leveraged in attacks BleepingComputer
  2. 2
    Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day The Hacker News
  3. 4
    New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges BleepingComputer
  4. 5
    HPE Patches Critical RCE Vulnerabilities in AOS-CX SecurityWeek
  5. 6
    Phishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters The Hacker News
  6. 7
    IDScan sued over alleged data breach affecting 153 million drivers BleepingComputer
  7. 8
    Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws The Hacker News
  8. 9
    Attackers exploit zero-days in consistently besieged SonicWall product CyberScoop
  9. 10
    Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal SecurityWeek