June 2026 CVE Landscape
60
CVE-2026-20253
KEV PoC largeUnauthenticated RCE in Splunk Enterprise via PostgreSQL sidecar endpoint
CISA: Splunk Enterprise Missing Authentication for Critical Function Vulnerability
CVSS 3.1
9.8 critical
EPSS
97%p100
Published
()
KEV added
AI analysis
CVE-2026-20253 is a critical (CVSS 9.8) missing-authentication flaw (CWE-306) in the PostgreSQL sidecar service endpoint of Splunk Enterprise, which lacks authentication controls. Any unauthenticated user who can reach the endpoint over the network can invoke file operations without credentials, creating or truncating arbitrary files on the host; public research (watchTowr) and news coverage describe this leading to pre-authentication remote code execution. The flaw affects Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, while versions 9.4 and earlier are not affected. Exploitation is confirmed: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-18, media reports indicate it is under active attack, and EPSS assigns a 96.9% probability of exploitation within 30 days.
What to do: Upgrade to Splunk Enterprise 10.2.4 (10.2 track) or 10.0.7 (10 track) or later; Splunk Enterprise 9.4 and earlier are unaffected. If you cannot upgrade immediately, disable the PostgreSQL sidecar service per vendor guidance and ensure the endpoint is not reachable from untrusted networks. As a KEV entry, federal agencies must apply vendor mitigations in line with BOD 26-04 by the CISA deadline; audit whether the PostgreSQL sidecar service is enabled and whether it is exposed to the internet.
Affected
| Splunk (Cisco) Splunk Enterprise | 10.2 versions below 10.2.4 and 10 versions below 10.0.7 (versions 9.4 and earlier are not affected) |
Estimated exposure
largeTens of thousands of internet-exposed Splunk Enterprise instances, though only 10.x deployments with the sidecar service are vulnerable — Public internet scans have historically indexed tens of thousands of Splunk instances and Splunk Enterprise has a large enterprise and government installed base, but the affected population is limited to 10.x deployments where the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.
CISA Known Exploited Vulnerability
- Affected
- Splunk Enterprise
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- splunk
- Products
- splunk
- Weakness
- CWE-306
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news6 stories
60
60
60
60
60