PostgreSQL releases since 2014 contain a severe vulnerability that allows attacker with low privileges to take over databases and servers, cybersecurity firm Cyera reports.

An open source relational database system offering support for both relational (SQL) and non-relational (JSON) queries, PostgreSQL is one of the most popular databases, being used by tens of thousands of companies, including large enterprises.

Tracked as CVE-2026-6471 (CVSS score of 7.2) and referred to as PostGREShell, the recently identified security defect can be exploited for remote code execution and privilege escalation.

It is described as a missing authorization in the database’s logical decoding and can be exploited by attackers that have ‘Replication’ privileges to load any file visible to the OS account running the server, via the logical decoding plugin.

PostgreSQL, Cyera explains, uses a dedicated replication protocol to sync multiple replicas of any primary database, for backup and recovery. An account with the Replication attribute is required for that, and one is provided to any connected backup tool, server, pipeline, and monitoring utility.

Changes are recorded by local replication as table events, so that external tools can read, which they do by creating a logical replication slot and naming an output plugin that is loaded by PostgreSQL to format the stream.

When a plugin is loaded, PostgreSQL runs their init function with the privileges of the server process. To prevent abuse, non-superusers can only load plugins from an admin-controlled directory.

Cyera discovered that the plugin’s name is passed directly to the loader, without validation or sanitization, which allows an attacker to hand the loader a full filesystem path that is served to dlopen(), the C/C++ function used to dynamically load shared libraries.

“The replication protocol’s parser accepts almost any character inside a double-quoted plugin name: slashes, backslashes, dots, ../ traversal, even Windows UNC paths,” Cyera notes.

This allows an attacker to load and execute any file through dlopen(), and the file is executed with the privileges of the postgres system user.

“Code loaded via dlopen() runs in the same address space as PostgreSQL, with no sandbox and no checks on internal API calls. The server simply trusts any code that was loaded,” Cyera explains.

“So the plugin calls an internal function to become the bootstrap superuser for the session, then writes directly to pg_authid, the catalog table that defines who is a superuser, and flips every privilege flag to true,” the company continues.

At this point, the attacker has obtained permanent superuser privileges: they can access every table in every database, execute OS commands, read private keys, and write files to any location the postgres process has access to.

According to Cyera, the plugin can also deploy backdoor mechanisms: it can enable connections without passwords, copies itself to a stable location and registers itself to be re-loaded into every new backend, and can re-apply the superuser change even if it is reverted.

“PostGREShell turns the Replication credential nobody worries about into code execution, superuser, and a persistent backdoor on the database behind much of the internet. Every version from 9.4 through 18 is affected (we confirmed it on 18.2), and logical replication is now standard production plumbing, so the vulnerable path exists almost everywhere PostgreSQL runs,” Cyera notes.

CVE-2026-6471 has been patched in PostgreSQL versions 18.6, 17.11, 16.15, 15.19, and 14.24. Organizations are advised to update their instances as soon as possible, audit their Replication accounts, and remove the Replication attribute from any account that does not need it.

Related: Rockwell Automation Patches Over a Dozen Vulnerabilities Across Products

Related: OpenLeash Adds a Human Check to Risky AI Agent Actions

Related: Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia

Related: New HollowGraph Malware Abuses Microsoft 365 Calendar for C&C Communication

https://www.securityweek.com/12-year-old-postgresql-vulnerability-enables-database-server-takeover/

Broadcom on Thursday announced patches for two critical and high-severity vulnerabilities in VMware Workstation and Fusion.

The first issue, tracked as CVE-2026-59346 (CVSS score of 9.3), is described as an integer overflow bug leading to arbitrary code execution.

“A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host,” Broadcom notes in its advisory.

Tracked as CVE-2026-59347 (CVSS score of 8.1), the second flaw is a stack-based buffer overflow that could lead to similar outcomes, albeit the exploitation conditions are different.

“A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine’s VMX process running on the host,” Broadcom explains.

Both vulnerabilities affect VMware Workstation and VMware Fusion versions 25H2 and 26H1 and were resolved in version 26H1u1.

There are no workarounds for either of the flaws, and Broadcom recommends updating to a patched iteration as soon as possible.

The company makes no mention of any of these vulnerabilities being exploited in the wild, and says that both issues were reported to it privately.

However, security defects in VMware products are often exploited by threat actors. More than two dozen VMware vulnerabilities are currently included in CISA’s KEV list.

Related: CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities

Related: Exploit Published for Fresh Cleo Harmony Vulnerability

Related: SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks

Related: Hackers Start Exploiting Critical Langflow Vulnerability

https://www.securityweek.com/vmware-workstation-and-fusion-updates-patch-critical-vulnerability/

Google on Thursday rolled out fresh Chrome 152 security updates that resolve 12 vulnerabilities, including an exploited zero-day.

Tracked as CVE-2026-85046, the high-severity bug is described as a type confusion issue in Chrome’s V8 JavaScript and WebAssembly engine. It was reported by Salvatore Gulizia, who received a $1,000 bug bounty reward.

“Google is aware that an exploit for CVE-2026-85046 exists in the wild,” the internet giant’s advisory reads.

While the company has not shared details on the security defect, type confusion flaws in the V8 engine may be exploited to perform remote read/write operations via crafted HTML pages.

Type confusion vulnerabilities are memory corruption bugs that could lead to crashes, remote code execution, and other malicious behavior.

CVE-2026-85046 is the sixth Chrome zero-day patched in 2026. The other five are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645.

The security defect was resolved in Chrome versions 152.0.7977.82/.83 for Windows and macOS, and version 152.0.7977.82 for Linux.

The updates address nine other high-severity bugs, including out-of-bounds read/write, incomplete cleanup, use-after-free, race condition, improper resource exposure, and type confusion issues. Three of them have been reported by external researchers.

Additionally, Google fixed two medium-severity improper input validation and use-after-free weaknesses.

Related: Chrome and Firefox Updates Patch Dozens of Vulnerabilities

Related: Chrome 152 Patches Over 300 Vulnerabilities

Related: Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability

Related: Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities

https://www.securityweek.com/google-patches-6th-chrome-zero-day-of-2026/

The high-severity SQL injection flaw (CVE-2026-19949) could allow unauthenticated attackers to achieve remote code execution.

The post Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability appeared first on SecurityWeek.

https://www.securityweek.com/over-3-million-wordpress-sites-affected-by-migration-plugin-vulnerability/

Publicly disclosed S/MIME flaws could expose encrypted email content, while critical IOS XR and Nexus bugs could enable remote code execution and authentication bypass.

The post Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities appeared first on SecurityWeek.

https://www.securityweek.com/cisco-warns-of-unpatched-secure-email-flaws-patches-critical-switch-vulnerabilities/

The security defect allows remote attackers to bypass authentication through argument bearer manipulation.

The post Exploit Published for Fresh Cleo Harmony Vulnerability appeared first on SecurityWeek.

https://www.securityweek.com/exploit-published-for-fresh-cleo-harmony-vulnerability/

The browser refreshes fix multiple use-after-free, sandbox escape, and privilege escalation bugs.

The post Chrome and Firefox Updates Patch Dozens of Vulnerabilities appeared first on SecurityWeek.

https://www.securityweek.com/chrome-and-firefox-updates-patch-dozens-of-vulnerabilities/

The vulnerabilities CVE-2026-83549 and CVE-2026-83548 can be chained for unauthenticated remote code execution.

The post SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks appeared first on SecurityWeek.

https://www.securityweek.com/sonicwall-warns-of-two-sma1000-zero-days-exploited-in-attacks/

Cisco on Wednesday rolled out patches for two dozen vulnerabilities across its products, including critical-severity bugs in Catalyst SD-WAN, IOS XE, and Secure Firewall Management Center (FMC).

For Catalyst SD-WAN, the company released five fixes, noting that the CVEs were assigned to multiple weaknesses grouped by the underlying vulnerability class.

Three of the CVEs, namely CVE-2026-20303, CVE-2026-20304, and CVE-2026-20310, have a CVSS score of 9.9 and are described as improper input validation, improper access control, and improper link resolution before file access.

The remaining two, CVE-2026-20312 and CVE-2026-20313, are high-severity flaws described as cleartext storage of sensitive information and improper validation of specified quantity in input.

IOS XE received seven fixes, and the assigned CVEs group multiple issues by their underlying vulnerability class.

Two of them, CVE-2026-20272 (CVSS score of 9.8) and CVE-2026-20267 (CVSS score of 9.0), are critical-severity command injection and improper access control defects, while the rest are high-severity flaws.

FMC received patches for CVE-2026-20079 (CVSS score of 10), a critical authentication bypass that allows remote, unauthenticated attackers to execute scripts and gain root privileges.

“An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device,” Cisco notes.

The company also patched high-severity security defects in Integrated Management Controller (IMC), IOS XE, and IOS, and medium-severity bugs in IOS XE, Terminal Service (TS) Agent, Catalyst SD-WAN Manager, RoomOS, and IMC.

Of these, CVE-2026-20200 (CVSS score of 8.8) deserves special attention. It is a high-severity improper validation of user-supplied input issue in IMC that could be exploited remotely to execute arbitrary commands and gain root privileges.

While the flaw’s exploitation requires authentication, proof-of-concept (PoC) code targeting it exists, Cisco warns. The weakness affects UCS C-Series M7 and M8 Rack Servers in standalone mode.

Cisco says it is not aware of any of these vulnerabilities being exploited in the wild. Additional information can be found on the company’s security advisories page.

Related: Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability

Related: Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks

Related: N‑able Patches Vulnerability Exploited to Hack N-central Servers

Related: Ruby on Rails Patches Critical Vulnerability

https://www.securityweek.com/cisco-patches-critical-sd-wan-ios-xe-fmc-vulnerabilities/

Threat actors have started exploiting a recently patched vulnerability in JetBrains TeamCity, the US cybersecurity agency CISA warns.

A continuous integration and continuous delivery (CI/CD) platform, TeamCity provides automated software building and deployment and is a central component of enterprise workflows, collaboration, and development practices.

Tracked as CVE-2026-63077 (CVSS score of 9.8), the critical security defect is related to deserialization of untrusted data and allows unauthenticated attackers to achieve remote code execution (RCE) via HTTP/S requests.

Impacting all TeamCity On-Premises versions, the flaw enables attackers to “bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process,” JetBrains warned last week.

Patches for the issue were included in TeamCity versions 2025.11.7 and 2026.1.3. A security patch plugin for version 2017.1+ was also released.

“An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol,” JetBrains said, urging organizations to apply the patches to their TeamCity On-Premises deployments as soon as possible.

In its advisory, JetBrains noted that the security defect was reported privately and that it was not aware of any active exploitation.

On Wednesday, roughly a week after public disclosure, CISA added CVE-2026-63077 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04.

There does not appear to be any public information on the attacks exploiting the vulnerability.

Related: How a $50,000 Exploit Chain Turned Bixby Against Samsung Phones

Related: New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts

Related: CISA Warns of Exploited Langflow, N-central, and Tomcat Vulnerabilities

Related: Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering

https://www.securityweek.com/hackers-start-exploiting-recent-jetbrains-teamcity-vulnerability/