high CVSS 8.8 EPSS 0.68%

CVE-2026-16239·PostgreSQL vulnerability

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity
high
Software
PostgreSQL
Fixed in
18.5
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.68% — higher than 52% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-16239 scores 8.8 on CVSS, so a successful attack would be serious — but at 0.68%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 18.0

Until: 18.5

Fixed in: 18.5

How to fix this CVE

PostgreSQL versions 18.0 through 18.5 contain a type confusion vulnerability in cursor and portal handling that allows authenticated database users to execute arbitrary code with database process privileges. Immediately upgrade to PostgreSQL 18.6 or later, or apply vendor security patches for versions 17.11, 16.15, 15.19, and 14.24. Review database access controls and audit user privileges to minimize exposure from authenticated attackers.

sudo dnf upgrade postgresql postgresql-server postgresql-contrib

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed PostgreSQL version: psql --version or SELECT version();
  2. Verify vulnerability exposure: SELECT version(); — if output shows version 18.0-18.5 or vulnerable older versions (17.0-17.10, 16.0-16.14, 15.0-15.18, 14.0-14.23), the system is at risk.
  3. Search PostgreSQL logs for repeated cursor/portal recreation attempts: grep -i 'cursor\|portal' /var/log/postgresql/*.log | grep -i 'error\|invalid\|type'
  4. Confirm patch application: psql --version should show 18.6+ or vendor-patched version; verify with SELECT version(); from within a database connection.

FAQ

What is CVE-2026-16239?

CVE-2026-16239 is a type confusion flaw in PostgreSQL's cursor and portal lifecycle management that enables authenticated users to trigger arbitrary code execution with database server privileges by manipulating portal recreation with mismatched data types.

Is CVE-2026-16239 being actively exploited?

No, CVE-2026-16239 is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploits have been disclosed.

What versions of PostgreSQL are affected by CVE-2026-16239?

PostgreSQL 18.0 through 18.5, 17.0 through 17.10, 16.0 through 16.14, 15.0 through 15.18, and 14.0 through 14.23 are vulnerable. Fixed versions are 18.6, 17.11, 16.15, 15.19, and 14.24 respectively.

How do I check if my server is vulnerable to CVE-2026-16239?

Connect to PostgreSQL and run: SELECT version(); — if the version number is within the vulnerable ranges listed above, your installation requires patching.

Does Defensia detect CVE-2026-16239?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-16239 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14677CVSS 8.8Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14676CVSS 8.8Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.
CVE-2026-14680CVSS 8.8Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670CVSS 8.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-16239. Free for 1 server.

Get started free