CVE intelligence

CVE-2026-14661

Vulnerability intelligence

Published Nov 12, 2026Sources checked Nov 12, 2026

8.1HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-14661 and is rated High severity with a CVSS score of 8.1. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Nov 14, 2026

Release Notes

CISA KEVNot listedBased on the latest collected catalog

EPSSUnavailableNo current score collected

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-14661?

External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the "sslkeylogfile" connection parameter appends data, in NSS keylog format, to a file of the user's choosing.

This "sslkeylogfile" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected.

Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server.

Source: NVD