If you run PostgreSQL on Azure Linux, check who owns your logical-replication subscriptions and whether your package source has a fixed build. Microsoft has now identified affected packages, and upstream PostgreSQL has released the fixes.
What changed. PostgreSQL published its security release on November 12, 2026. Microsoft added Azure Linux package applicability on November 13–14. The November 14 CVRF revisions for CVE-2026-116304 and CVE-2026-120145 identify Azure Linux 3.0 postgresql 16.15-1 and Azure Linux 4.0 preview postgresql16 16.15-5.azl4, postgresql17 17.11-5.azl4, and postgresql18 18.6-5.azl4. Microsoft lists these builds and provides no broader Azure Linux affected range or fixed build in those rows. Last verified November 14, 2026 UTC.
Which deployments to prioritize
CVE-2026-116304. A database user can gain code execution under the database service account through a flaw in parallel-query processing. CVE-2026-120145. A compromised logical-replication publisher can gain code execution on a subscriber when the subscription is owned by a database superuser. Microsoft rates both Important, CVSS 8.8 v3.1. The reviewed official sources did not confirm exploitation in the wild, and neither CVE appears in the current CISA KEV catalog.
Suggested MSP priority. Prioritize self-managed databases reachable by less-trusted users and replication that crosses customer, partner, or other trust boundaries. Check Azure Database for PostgreSQL Flexible Server through its service maintenance and release notes. A managed-service rollout for these CVEs is unverified.
Fixes and verification
For supported upstream installations, upgrade within the installed major branch to 18.7, 17.12, 16.16, 15.20, or 14.25 or later. PostgreSQL 14 reached end of support with this release. Microsoft’s Azure Linux 3.0 change to 16.16 is still an open packaging pull request. A fixed Microsoft RPM could not be verified for either production architecture. Confirm the supported package or image for your deployment before scheduling an update.
Inventory running server and package versions, database access, and subscription owners. Restrict database access and isolate any untrusted publisher where operationally safe while arranging the supported update. Verify the active server version after restart and check replication and application health. PostgreSQL recommends taking a fresh full backup after the update if you use incremental backups, then using it as the base for future incrementals. Review the release notes for applicable reindexing and other follow-up steps.
Sources. Microsoft November CVRF, PostgreSQL security release and update steps, CVE-2026-116304, CVE-2026-120145, Microsoft package change, Microsoft x64 RPMs, Microsoft Arm64 RPMs, Flexible Server release notes, CISA KEV catalog data.
CVE IDs in the Microsoft PostgreSQL package cluster. CVE-2026-116303, CVE-2026-116304, CVE-2026-116306, CVE-2026-116307, CVE-2026-116308, CVE-2026-116309, CVE-2026-116311, CVE-2026-116312, CVE-2026-116313, CVE-2026-116314, CVE-2026-116315, CVE-2026-116316, CVE-2026-116317, CVE-2026-116318, CVE-2026-116319, CVE-2026-116320, CVE-2026-116321, CVE-2026-116322, CVE-2026-116323, CVE-2026-116325, CVE-2026-116326, CVE-2026-116327, CVE-2026-116328, CVE-2026-116329, CVE-2026-116330, CVE-2026-116331, CVE-2026-116332, CVE-2026-116333, CVE-2026-116335, CVE-2026-116336, CVE-2026-120139, CVE-2026-120141, CVE-2026-120142, CVE-2026-120143, CVE-2026-120144, CVE-2026-120145, CVE-2026-120146, CVE-2026-120147, CVE-2026-120148, CVE-2026-120149, CVE-2026-120150, CVE-2026-120151, CVE-2026-120152, CVE-2026-120153, CVE-2026-120154, CVE-2026-14661, CVE-2026-16237, CVE-2026-16240, CVE-2026-18447, CVE-2026-6460, CVE-2026-6467.