Red Hat PostgreSQL 15 Update Addresses Nine RHEL 9 Flaws
Tech GuruQuick Answer
RHSA-2026:69698 updates PostgreSQL 15 in the RHEL 9.6 EUS postgresql:15 module. Install the complete supported module package set for that stream; this is not an instruction to migrate to another PostgreSQL major version.
Confirm Scope And Apply The Supported Fix
What to do now: Record the database major version, module stream, extensions and replication topology, then schedule the supported 15.19 update with a tested backup/recovery plan.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | PostgreSQL 15 packages for RHEL 9.6 EUS |
|---|---|
| Advisory | RHSA-2026:69698 |
| CVEs | CVE-2026-14662, CVE-2026-14664, CVE-2026-14669, CVE-2026-14677, CVE-2026-14680, CVE-2026-15742, CVE-2026-16239, CVE-2026-19385, CVE-2026-6471 |
| Authoritative release date | RHSA-2026:69698: 2026-09-21T23:23:31+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69698: 2026-09-21T23:23:31+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | PostgreSQL 15 packages in the RHEL 9.6 EUS module before the advisory fixed build; individual CVEs have additional privilege, extension or architecture prerequisites. |
| Fixed version | RHEL 9.6 EUS, postgresql:15: PostgreSQL 0:15.19-1.module+el9.6.0+24906+1a0a7a43, with the matching advisory-listed module packages for the architecture. |
| CVSS base score | 7.2 / 7.5 / 8.8 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | RHSA-2026:69698 does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
The nine CVEs span text search, regular expressions, timezone parsing, procedural languages, internal argument handling, fuzzy-string matching, cursor lifecycle, pg_dump transforms and logical decoding. Their prerequisites differ: for example, the pltcl/plperl issue is specific to 32-bit systems and the logical-decoding vector requires high privileges. Do not describe the whole group as unauthenticated remote code execution.
What To Validate Now
- Inventory. Record PostgreSQL package releases, enabled module, architecture, extensions, replicas, application owners and backup/restore readiness.
- Establish applicability. Match the installed postgresql:15 stream and RHEL 9.6 EUS repository to RHSA-2026:69698, then review each CVE's feature and privilege conditions.
- Remediate. Apply the full supported 15.19 module update for this stream. Do not switch major versions or drop extensions merely to satisfy generic workaround text; assess any temporary privilege restriction with the database owner.
- Validate. Confirm PostgreSQL server/client package releases and the running server version. Test application queries, installed extensions, replica health and normal dump/restore workflows in the approved environment; record restart and recovery results.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
