U.S. CISA adds Splunk Enterprise flaw to its Known Exploited Vulnerabilities catalog and urges agencies to fix it by Sunday
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-20253 | Unauthenticated RCE in Splunk Enterprise via PostgreSQL sidecar endpoint CVE-2026-20253 is a critical (CVSS 9.8) missing-authentication flaw (CWE-306) in the PostgreSQL sidecar service endpoint of Splunk Enterprise, which lacks authentication controls. Any unauthenticated user who can reach the endpoint over the network can invoke file operations without credentials, creating or truncating arbitrary files on the host; public research (watchTowr) and news coverage describe this leading to pre-authentication remote code execution. The flaw affects Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, while versions 9.4 and earlier are not affected. Exploitation is confirmed: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-18, media reports indicate it is under active attack, and EPSS assigns a 96.9% probability of exploitation within 30 days. Do: Upgrade to Splunk Enterprise 10.2.4 (10.2 track) or 10.0.7 (10 track) or later; Splunk Enterprise 9.4 and earlier are unaffected. If you cannot upgrade immediately, disable the PostgreSQL sidecar service per vendor guidance and ensure the endpoint is not reachable from untrusted networks. As a KEV entry, federal agencies must apply vendor mitigations in line with BOD 26-04 by the CISA deadline; audit whether the PostgreSQL sidecar service is enabled and whether it is exposed to the internet. | 9.8 | 97% | KEV PoC |
| largeTens of thousands of internet-exposed Splunk Enterprise instances, though only 10.x deployments with the sidecar service are vulnerable |
Full article378 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Splunk Enterprise flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Splunk Enterprise flaw, tracked as CVE-2026-20253 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.
The flaw CVE-2026-20253 is an improper authentication vulnerability in the PostgreSQL sidecar service of Splunk Enterprise that allows unauthenticated remote attackers to create or truncate arbitrary files on affected systems. The issue stems from missing authentication controls on a PostgreSQL sidecar service endpoint, enabling any network-reachable user to invoke file operations without valid credentials.
“In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.” reads the advisory. “The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.”
Successful exploitation could lead to data loss, service disruption, or further compromise depending on the files targeted.
The vulnerability affects Splunk Enterprise 10.2 versions prior to 10.2.4 and 10.0 versions prior to 10.0.7, while versions 9.4 and earlier are not impacted. Organizations unable to immediately apply the available patches should mitigate the risk by disabling the PostgreSQL sidecar service.
Splunk PSIRT confirmed it is aware of limited active exploitation of the vulnerability and urged customers to immediately upgrade to patched versions to mitigate the risk. The company did not disclose technical details about the attacks targeting this issue.
“In June 2026, the Splunk Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability. Splunk strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.” continues the advisory.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerability by the end of this week, on June 21, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/193888/security/u-s-cisa-adds-splunk-enterprise-flaw-to-its-known-exploited-vulnerabilities-catalog-and-urges-agencies-to-fix-it-by-sunday.html