Unauthenticated RCE in Splunk Enterprise under active attack (CVE-2026-20253)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-20253 | Unauthenticated RCE in Splunk Enterprise via PostgreSQL sidecar endpoint CVE-2026-20253 is a critical (CVSS 9.8) missing-authentication flaw (CWE-306) in the PostgreSQL sidecar service endpoint of Splunk Enterprise, which lacks authentication controls. Any unauthenticated user who can reach the endpoint over the network can invoke file operations without credentials, creating or truncating arbitrary files on the host; public research (watchTowr) and news coverage describe this leading to pre-authentication remote code execution. The flaw affects Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, while versions 9.4 and earlier are not affected. Exploitation is confirmed: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-18, media reports indicate it is under active attack, and EPSS assigns a 96.9% probability of exploitation within 30 days. Do: Upgrade to Splunk Enterprise 10.2.4 (10.2 track) or 10.0.7 (10 track) or later; Splunk Enterprise 9.4 and earlier are unaffected. If you cannot upgrade immediately, disable the PostgreSQL sidecar service per vendor guidance and ensure the endpoint is not reachable from untrusted networks. As a KEV entry, federal agencies must apply vendor mitigations in line with BOD 26-04 by the CISA deadline; audit whether the PostgreSQL sidecar service is enabled and whether it is exposed to the internet. | 9.8 | 97% | KEV PoC |
| largeTens of thousands of internet-exposed Splunk Enterprise instances, though only 10.x deployments with the sidecar service are vulnerable |
Full article434 words · extracted from helpnetsecurity.com · click to collapse
CISA has added CVE-2026-20253, a critical, remotely exploitable vulnerability in Splunk Enterprise, to its Known Exploited Vulnerabilities catalog, and ordered US federal civilian agencies to apply mitigations by June 21, 2026.
In-the-wild exploitation has also been confirmed by the vendor and Resecurity, who said that its potential for full system compromise should push organizations to prioritize patching and review systems for indicators of compromise such as:
- Requests containing path traversal sequences (../)
- PostgreSQL connection parameters such as hostaddr=, dbname=, port=, or passfile=
- Unexpected execution of pg_dump or pg_restore
- Creation of database dump files in unusual filesystem locations
- Outbound connections from Splunk services to unknown PostgreSQL servers.
The vulnerability and its exploitation potential
Splunk Enterprise collects logs and data from across an organization’s IT systems and indexes them so they can be searched quickly using its own query language (SPL). It’s used for dashboards, alerts, and investigating issues, and essentially serves as the core platform for general IT monitoring and security (SIEM) use cases.
“In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint,” Splunk explained in the security advisory for CVE-2026-20253, published on June 10, 2026.
The PostgreSQL sidecar service is responsible for database backup and recovery operations, and the vulnerability is caused by the PostgreSQL sidecar service endpoint having no authentication controls and thus allowing attackers who can reach the service to invoke file operations without having valid credentials.
CVE-2026-20253 can be used by attackers to execute arbitrary code and achieve full control over the Splunk application environment. This may allow them to access, tamper with or delete security data; expose stored credentials; pivot to other internal systems; and more.
“Given Splunk’s central role in security monitoring and operational intelligence, compromise of the platform can significantly reduce organizational visibility, allowing additional malicious activity to proceed undetected,” Resecurity researchers added.
Patches and mitigation
Splunk released patches on June 10, and urged customers to upgrade to a fixed version: 10.4.0, 10.2.4 and 10.0.7, or higher.
On June 12, watchTowr researchers published a technical deep-dive into the flaw and published a “neutered” version of its exploit, which can be leveraged by organizations to check whether their Splunk Enterprise deployment is vulnerable to CVE-2026-20253.
A Nuclei detection template is also publicly available.
On June 15, the vendor confirmed that the vulnerability can be mitigated by disabling the PostgreSQL sidecar service, but noted that some functionality may be affected.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/06/19/splunk-vulnerability-cve-2026-20253-exploited/