On 12 and 13 November, the PostgreSQL Global Development Group released what is, by any measure, its biggest security update ever. All supported versions — 19 RC2, 18.7, 17.12, 16.16, 15.20 and 14.25 — received fixes for 52 security vulnerabilities, alongside a long list of regular bug fixes. For a database that quietly powers an enormous share of business websites, CRMs, ERPs and custom web applications in Switzerland, this is not a routine update to wait out until the next maintenance window.
Postgres is the engine behind countless invoicing systems, booking tools and customer portals that Swiss SMEs run themselves or through a developer. Many business owners have never heard of it by name, yet it sits underneath software they use every day. That makes this release relevant even if "database security" sounds like someone else's problem.
Why this patch wave is different
Of the 52 vulnerabilities fixed, 32 carry the same severe 8.8 CVSS score, meaning most of this release lands squarely in the critical band rather than being a mix of minor cleanups. That is an unusually high concentration of serious flaws in a single update.
The headline flaw, CVE-2026-6460, has reportedly existed in PostgreSQL's code for 22 years. It is a type confusion bug that lets any authenticated user who can create database objects — not necessarily an administrator — execute code directly on the server. In practice, this means a lower-privileged account, perhaps one belonging to a contractor, a third-party app, or a compromised employee login, could be used to escalate all the way to full server takeover.
A second flaw, CVE-2026-116322, allows an unauthenticated client to trigger a restart of PostgreSQL 18 servers — a straightforward way to disrupt availability without needing any credentials at all.
The patch alone may not be enough
This is the detail most admins will miss: simply running the installer does not guarantee protection. According to the technical write-up of this release, C-language extensions built before the patch can still load on an updated server without picking up the new security checks. If your Postgres setup uses custom or third-party extensions — common in more complex CRM or ERP deployments — those need to be rebuilt against the patched version, not just left in place and assumed safe.
There is also a deadline hiding in the announcement itself: this release is the final one for PostgreSQL 14. That version is now officially end-of-life. Any business still running it will receive no further security or bug fixes, ever, regardless of what new flaws surface next month or next year.
What to do this week
- Find out what version you run. Ask whoever manages your website, CRM or ERP database which PostgreSQL version is in use. If it's 14.x, plan an upgrade path immediately, not eventually.
- Apply the update now. Don't wait for a scheduled maintenance window — 32 critical-rated flaws in one release is reason enough to patch within days.
- Ask about extensions. If your developer or hosting provider uses custom C-language extensions, confirm they have been rebuilt, not just left loaded from before the patch.
- Check who has database create privileges. Since the worst flaw requires only the ability to create database objects, review which accounts — including app service accounts and contractor logins — actually need that level of access.
- Confirm with your hosting or software vendor. If a third party manages your database, ask them directly whether this update has been applied and whether PostgreSQL 14 is anywhere in your stack.
This release joins a long run of critical patches across business software this month — a reminder that vulnerability discovery, much of it now AI-assisted on the attacker side too, has become a constant background process rather than an occasional event. Flitz.ai is keeping an eye on this space and will keep reporting the fixes that matter most, in plain language, as they land.
If you're not sure which systems in your business run on PostgreSQL, or you simply want someone to check your infrastructure before small gaps turn into real problems, The Mejlerö Company (Flitz.ai) offers a free network analysis and a free one-hour consultation for businesses in Obwalden, Nidwalden, Lucerne and Zurich.
Switzerland.