Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-2004

35
FAUCET Score

CVE-2026-2004 is a critical vulnerability in the PostgreSQL intarray extension, affecting versions prior to 18.2, 17.8, 16.12, 15.16, and 14.21. It stems from missing input type validation, allowing an object creator to execute arbitrary code as the operating system user running the database. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk. It can be exploited remotely with low attack complexity and no user interaction, potentially leading to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered significant community discussion and media coverage, suggesting awareness within the security community.

Impacted Technologies

VendorProductVersion(s)CPE
>= 14.0, < 14.21CPE matchmatch criteria
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
>= 15.0, < 15.16CPE matchmatch criteria
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
>= 16.0, < 16.12CPE matchmatch criteria
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
>= 17.0, < 17.8CPE matchmatch criteria
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
>= 18.0, < 18.2CPE matchmatch criteria
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.8HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.78%
Probability of exploitation in next 30 days
EPSS Percentile
52.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0078 is in the 46th percentile among its peer group of 17,822 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (20)

beckhoffpatch availablevia llm_extracted
Fixed in: 18.2, 17.8, 16.12, 15.16, 14.21
View patch
dhis2patch availablevia llm_extracted
Fixed in: 18.2, 17.8, 16.12, 15.16, 14.21
View patch
fortinetpatch availablevia llm_extracted
Fixed in: 18.2, 17.8, 16.12, 15.16, 14.21
View patch
miniopatch availablevia llm_extracted
Fixed in: 18.2, 17.8, 16.12, 15.16, 14.21
View patch
navidromepatch availablevia llm_extracted
Fixed in: 18.2, 17.8, 16.12, 15.16, 14.21
View patch
netscoutpatch availablevia llm_extracted
Fixed in: 18.2, 17.8, 16.12, 15.16, 14.21
View patch
new_relicpatch availablevia llm_extracted
Fixed in: 18.2, 17.8, 16.12, 15.16, 14.21
View patch
nvidiapatch availablevia llm_extracted
Fixed in: 18.2, 17.8, 16.12, 15.16, 14.21
View patch
ubuntupatch availablevia ubuntu_usn
Product: postgresql-16 (noble)Fixed in: 16.13-0ubuntu0.24.04.1
ubuntupatch availablevia ubuntu_usn
Product: postgresql-14 (jammy)Fixed in: 14.22-0ubuntu0.22.04.1
ubuntupatch availablevia ubuntu_usn
Product: postgresql-17 (questing)Fixed in: 17.9-0ubuntu0.25.10.1
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: postgresql18
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: postgresql:16/postgresql
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: postgresql:15/postgresql
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: postgresql
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: postgresql:16/postgresql
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: postgresql:15/postgresql
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: postgresql:13/postgresql
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: postgresql:12/postgresql
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: postgresql16

Vendor Advisories (10)

ubuntuUSN-8072-1

PostgreSQL vulnerabilities

Mar 4, 2026
redhatCVE-2026-2004Important

postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

Feb 12, 2026
fortinetllm-fortinet-8be3062b139d0297HIGH

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

Jan 1, 2026
new_relicllm-new_relic-b9ee21fa5ff9d080HIGH

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

dhis2llm-dhis2-d24afddf6cd828c4HIGH

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

miniollm-minio-74988ad3ef384fecHIGH

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

navidromellm-navidrome-687f02793e5eb10cHIGH

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

nvidiallm-nvidia-7444d5ff9d5dc9ebHIGH

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

beckhoffllm-beckhoff-90203e0187554031HIGH

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

netscoutllm-netscout-a69c850fd5b9f3fbHIGH

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

References

access.redhat.com / errata/RHSA-2026:19009
access.redhat.com / errata/RHSA-2026:19010
access.redhat.com / errata/RHSA-2026:3730
access.redhat.com / errata/RHSA-2026:3887
access.redhat.com / errata/RHSA-2026:3896
access.redhat.com / errata/RHSA-2026:4024
access.redhat.com / errata/RHSA-2026:4059
access.redhat.com / errata/RHSA-2026:4063
access.redhat.com / errata/RHSA-2026:4064
access.redhat.com / errata/RHSA-2026:4074
access.redhat.com / errata/RHSA-2026:4075
access.redhat.com / errata/RHSA-2026:4110
access.redhat.com / errata/RHSA-2026:4254
access.redhat.com / errata/RHSA-2026:4441
access.redhat.com / errata/RHSA-2026:4475
access.redhat.com / errata/RHSA-2026:4504
access.redhat.com / errata/RHSA-2026:4505
access.redhat.com / errata/RHSA-2026:4506
access.redhat.com / errata/RHSA-2026:4509
access.redhat.com / errata/RHSA-2026:4515
access.redhat.com / errata/RHSA-2026:4516
access.redhat.com / errata/RHSA-2026:4518
access.redhat.com / errata/RHSA-2026:4524
access.redhat.com / errata/RHSA-2026:4528
access.redhat.com / errata/RHSA-2026:4544
access.redhat.com / errata/RHSA-2026:4546
access.redhat.com / errata/RHSA-2026:4547
access.redhat.com / errata/RHSA-2026:4548
access.redhat.com / errata/RHSA-2026:4943
access.redhat.com / errata/RHSA-2026:8756
access.redhat.com / security/cve/CVE-2026-2004
bugzilla.redhat.com / show_bug.cgi
security.access.redhat.com / data/csaf/v2/vex/2026/cve-2026-2004.json
postgresql.org / support/security/CVE-2026-2004
Vendor Advisory