CVE-2026-18893— CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities

Quick assessment

Affected

IBM CockroachDB PostgreSQL for IBM VPC

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

IBM CockroachDB PostgreSQL for IBM VPC 的 26.2.0 至 26.2.3、25.4.0 至 25.4.12，以及 25.2.0 至 25.2.20 版本存在通过用户定义函数（UDF）导致权限提升的漏洞。

CVSS 7.1 · High Updated Nov 09, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities

Source: CVE Program / CVE List V5

Vulnerability Description

IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

特权管理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
IBM	CockroachDB PostgreSQL for IBM VPC	26.2.0 ~ 26.2.3	`cpe:2.3:a:ibm:cockroachdb_postgresql_for_ibm_vpc:26.2.3:::::::*`

II. Public POCs for CVE-2026-18893

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-18893

请登录查看更多情报信息。

Other References for CVE-2026-18893 (1)

https://www.ibm.com/support/pages/node/7293292 vendor-advisory patch

https://www.cve.org/CVERecord?id=CVE-2026-18893

Same Patch Batch · IBM · 2026-11-08 · 69 CVEs total

CVE-2026-107331	9.9 CRITICAL	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-15266	9.8 CRITICAL	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-6715	9.8 CRITICAL	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-114464	9.3 CRITICAL	Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for Oc
CVE-2026-101117	9.1 CRITICAL	IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) a
CVE-2026-17466	9.1 CRITICAL	IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Li
CVE-2026-117545	8.8 HIGH	IBM webMethods Integration Server is vulnerable of bypassing the two-factor authentication
CVE-2026-110273	8.8 HIGH	Security Vulnerability identified in IBM TRIRIGA - Command Execution
CVE-2026-116501	8.4 HIGH	Qiskit SDK C API may trigger an out of bounds write on accessing the unitary matrix with q
CVE-2026-116499	8.4 HIGH	Arbitrary Code Execution in Qiskit SDK QPY Deserialization
CVE-2026-105467	8.1 HIGH	IBM QRadar SIEM is vulnerable to Open Redirect and Reflected XSS
CVE-2026-19133	8.1 HIGH	TS4500 Tape Library addresses security vulnerability
CVE-2026-107330	7.7 HIGH	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-18093	7.5 HIGH	IBM App Connect Enterprise is vulnerable to a credential exposure
CVE-2026-78537	6.8 MEDIUM	IBM Guardium Key Lifecycle Manager is affected by a security vulnerability
CVE-2026-82830	6.7 MEDIUM	IBM Guardium Data Protection is affected by multiple vulnerabilities
CVE-2026-3684	6.5 MEDIUM	Vulnerabilities exists in IBM Cloud Pak for Data System
CVE-2026-16427	6.5 MEDIUM	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-14437	6.5 MEDIUM	IBM Storage Scale Path Traversal
CVE-2026-16699	6.5 MEDIUM	Vulnerability exists in IBM Netezza Appliance

Showing top 20 of 69 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: CockroachDB PostgreSQL for IBM VPC

CVE-2026-18546
CockroachDB PostgreSQL for IBM VPC is affected by multiple v

Same vendor: IBM

Same weakness: CWE-269