Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure

Summary

A critical Splunk Enterprise vulnerability, CVE-2026-20253, is actively being exploited in attacks shortly after its public disclosure. The flaw allows unauthenticated remote code execution by creating or truncating arbitrary files via a PostgreSQL sidecar service. CISA has mandated federal agencies to patch this vulnerability by June 21st, marking the first Splunk flaw added to its Known Exploited Vulnerabilities catalog.

Full text

A critical Splunk Enterprise vulnerability is being exploited in attacks only days after its public disclosure, and organizations have been urged to patch it immediately. The vulnerability is tracked as CVE-2026-20253 and Splunk’s advisory says it can be exploited by an unauthenticated attacker to create or truncate arbitrary files via a PostgreSQL sidecar service endpoint. “The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials,” Splunk said in its advisory. The security hole affects Splunk Enterprise versions 10.2 before 10.2.4 and 10.0 before 10.0.7. Cisco-owned Splunk announced the availability of patches on June 10. Two days after its disclosure, researchers at cybersecurity firm WatchTowr demonstrated how CVE-2026-20253 can be exploited by an unauthenticated attacker for remote code execution, publishing technical details and PoC code. Exploitation of the vulnerability was confirmed by Splunk on June 18.Advertisement. Scroll to continue reading. “In June 2026, the Splunk Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability,” Splunk said. “Splunk strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.” There does not appear to be any publicly available information about the attacks involving CVE-2026-20253, but many enterprises may be at risk. CISA added CVE-2026-20253 to its Known Exploited Vulnerabilities (KEV) catalog on June 18 and instructed federal agencies to address it by June 21. This is the first Splunk flaw added to CISA’s KEV list. Related: Atlassian, Splunk Patch Critical Vulnerabilities Related: Majority of Internet-Accessible REDCap Servers Outdated Related: F5 Patches Critical, High-Severity NGINX Vulnerabilities Related: Critical Command Execution Vulnerability Patched in Cisco ISE Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs SailPoint to Acquire Entro in Reported $200 Million DealKodak Admits Data Breach After ShinyHunters Hack Claims1Password Acquires Apono in Reported $250M-$300M DealRockwell Automation Patches Vulnerabilities in ICS Controllers and SoftwareOracle’s Second Monthly Security Updates Deliver 245 Patches 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker CrosshairsiRhythm Confirms Data Stolen in HackCal Water Investigating Iranian Hackers’ Claims Latest News Majority of Internet-Accessible REDCap Servers OutdatedAccenture to Acquire Majority Stake in Dragos, All of runZero, NetRise in $4.1 Billion OT Cybersecurity PushNo Exploits RequiredDream Raises $260 Million at $3 Billion ValuationAtlassian, Splunk Patch Critical VulnerabilitiesRokarolla Banking Trojan Targets 200 ApplicationsCritical Command Execution Vulnerability Patched in Cisco ISEF5 Patches Critical, High-Severity NGINX Vulnerabilities Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: How Modern Breaches Bypass MFA and Evade Detection June 17, 2026 Today’s attackers are no longer breaking in — they’re logging in. Join this live webinar as we break down the modern identity attack chain and examine how recent breaches exploited weaknesses in authentication, identity verification, and access management processes. Register Webinar: Modern Exposure Validation in the AI Era June 24, 2026 AI has accelerated both sides of the fight. Adversaries are weaponizing vulnerabilities faster, while defenders are racing to ship detections and configurations. Join this live webinar as we explore how to prove your controls actually hold against new threats, map your security maturity, and unite breach simulation with automated pentesting into a single, coordinated program. Register People on the MoveSolarWinds has appointed Justin Henkel as Chief Information Security Officer.J. Paul Haynes has joined Cinchy as Chief Executive Officer.Hatem Naguib has become Chief Executive Officer at Sysdig.More People On The MoveExpert Insights No Exploits Required Four decades of incident response experience suggest that exploits are often the symptom, not the root cause, of today’s cybersecurity failures. (Tod Beardsley) After AI Reaches Production: 12 Ways Security Teams Can Take Control Security teams need more than visibility into AI applications, they need a repeatable framework for monitoring, investigating, and defending them in production. (Joshua Goldfarb) Everybody Is Vibe Coding But Nobody Told the Security Team AI-driven development is not something organizations can or should block. But it must be governed. (Danelle Au) The Zero-Knowledge Threat Actor and the End of Responsible Disclosure AI can help attackers generate malware, create malicious payloads, bypass simple security checks, and convert vague malicious intent into functional code. (Etay Maor) Raising the Cybersecurity Stakes: Ante up for the Agentic Era CISOs are now facing machine-speed attacks and asking, “How do I agent?” The industry must provide remediation at scale. (Nadir Izrael) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-20253

Entities