Is CVE-2026-119922 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119922 being exploited in the wild.

How severe is CVE-2026-119922?

High severity, with a CVSS score of 8.8, published 3 November 2026.

Which products and versions are affected?

AWS Babelfish for PostgreSQL 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4.

Is there a fix for CVE-2026-119922?

Yes: fixed in Babelfish for PostgreSQL 4.10, 5.6, 6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119922 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119922?

Check whether you run Amazon AWS or AWS Babelfish for PostgreSQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119922: Babelfish for PostgreSQL privilege escalation

CVE-2026-119922 · Severity: high · CVSS 8.8 · Published 2026-11-03

Babelfish for PostgreSQL is an AWS-developed extension that allows organizations to run SQL Server workloads directly on PostgreSQL without rewriting applications. A flaw in the extension's access control mechanisms allows authenticated users to elevate their privileges to higher permission levels. An attacker with database credentials could gain administrative access, compromising data confidentiality, integrity, and availability.

Technologies: Amazon AWS, AWS Babelfish for PostgreSQL. Vendors: Amazon, AWS.

Quick answers

Is CVE-2026-119922 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119922 being exploited in the wild.
How severe is CVE-2026-119922?: High severity, with a CVSS score of 8.8, published 3 November 2026.
Which products and versions are affected?: AWS Babelfish for PostgreSQL 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4.
Is there a fix for CVE-2026-119922?: Yes: fixed in Babelfish for PostgreSQL 4.10, 5.6, 6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119922 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119922?: Check whether you run Amazon AWS or AWS Babelfish for PostgreSQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Babelfish for PostgreSQL 4.10, 5.6, 6.1 or later

Technical details

Improper access control in Babelfish for PostgreSQL extension allows remote authenticated users to escalate privileges beyond their assigned role. The vulnerability affects multiple versions across multiple release branches. A fix is available in versions 4.10, 5.6, and 6.1 or later, and upgrading is required as no workaround exists.

Affected products

AWS Babelfish for PostgreSQL 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4

Timeline

2026-11-03: disclosed

References

https://aws.amazon.com/security/security-bulletins/rss/2026-165-aws/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.