Is CVE-2026-6460 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6460 being exploited in the wild.

How severe is CVE-2026-6460?

High severity, with a CVSS score of 8.8, published 12 November 2026.

Which products and versions are affected?

PostgreSQL before 14.25, 15.20, 16.16, 17.12, 18.7.

Is there a fix for CVE-2026-6460?

Yes: fixed in PostgreSQL 14.25, 15.20, 16.16, 17.12, 18.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6460 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6460?

Check whether you run PostgreSQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6460: PostgreSQL type confusion in ALTER allows arbitrary code execution

CVE-2026-6460 · Severity: high · CVSS 8.8 · Published 2026-11-12

PostgreSQL is a widely-used open-source database system that organizations rely on to store and manage critical data. A type confusion vulnerability allows any user who can create database objects to execute arbitrary code with the privileges of the operating system account running the database server, potentially compromising all data and systems that depend on it. An attacker needs only basic database creation privileges to exploit this via ALTER commands.

Technologies: PostgreSQL. Vendors: PostgreSQL.

Quick answers

Is CVE-2026-6460 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6460 being exploited in the wild.
How severe is CVE-2026-6460?: High severity, with a CVSS score of 8.8, published 12 November 2026.
Which products and versions are affected?: PostgreSQL before 14.25, 15.20, 16.16, 17.12, 18.7.
Is there a fix for CVE-2026-6460?: Yes: fixed in PostgreSQL 14.25, 15.20, 16.16, 17.12, 18.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6460 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6460?: Check whether you run PostgreSQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: PostgreSQL 14.25, 15.20, 16.16, 17.12, 18.7

Technical details

Type confusion in PostgreSQL's type tracking system allows attackers to create stale or mistyped values in data dictionary entries and PL/pgSQL variables through DDL operations, primarily ALTER ... SET DATA TYPE and ALTER TABLE ... ADD COLUMN with ROLLBACK sequences. The vulnerability is exploitable by any database object creator with network access (authentication required) and results in arbitrary code execution as the database's OS user. Fixes are available in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25.

Affected products

PostgreSQL PostgreSQL before 14.25, 15.20, 16.16, 17.12, 18.7

Timeline

2026-11-12: disclosed
2026-11-12: patched

References

https://www.postgresql.org/support/security/CVE-2026-6460/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.