CVE-2026-20253 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-06-10

Added to CISA KEV: 2026-06-18 8 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review Splunk and system logs for unexpected file creation/truncation, unauthorized access to the PostgreSQL sidecar endpoint, unexpected web shells or modified binaries, and verify system integrity.
IMMEDIATE: Upgrade Splunk Enterprise to 10.2.4 or later (for 10.2.x) or 10.0.7 or later (for 10.0.x). For Splunk Cloud Platform, confirm Splunk has applied fixes.
If immediate patching is not possible, apply the vendor mitigation: disable the PostgreSQL sidecar service if not required for your deployment. Restrict network access to Splunk management/service ports via firewall/ACLs and remove any direct internet exposure.
Monitor for exploitation: deploy detections for anomalous file operations, unexpected process execution under the Splunk service account, and network connections to the sidecar endpoint from untrusted sources.
Patch Priority: EMERGENCY / P0 — actively exploited, unauthenticated, critical CVSS, pre-auth RCE. Patch within CISA KEV mandated timeframe (immediately).

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-20253 is a critical vulnerability affecting Splunk Enterprise and Splunk Cloud Platform caused by a missing authentication control (CWE-306) within a PostgreSQL sidecar service endpoint. Because this endpoint lacks necessary credential verification, it allows remote, unauthenticated attackers to perform arbitrary file operations—specifically the creation or truncation of files—on the underlying host system. This vulnerability is highly significant because it can be chained to achieve Remote Code Execution (RCE), poses a severe threat to data integrity and system availability, and has been actively exploited in the wild.

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild and is included in CISA’s Known Exploited Vulnerabilities (KEV) catalog ^[1]^[2].
Threat Actors: While specific named threat groups are not universally cited, the Splunk Product Security Incident Response Team (PSIRT) confirmed limited exploitation as of June 2026 ^[1].
PoC Availability: Public proof-of-concept information and research detailing the exploitation chain have been documented and are available to security researchers ^[3]^[6].
Attack Prerequisites:

- Access: The attacker requires network-level access to the vulnerable PostgreSQL sidecar service endpoint ^[5]. - Authentication: No authentication is required ^[4]. - User Interaction: No user interaction is required ^[3].

Affected Products & Patches

Affected Versions: Splunk Enterprise versions below 10.2.4 and versions below 10.0.7 ^[4].
Patches: Customers are strongly advised to upgrade to the latest fixed software releases provided by Splunk to fully remediate the issue ^[1].
Mitigations: As a temporary mitigation, administrators have been advised to disable the PostgreSQL service if it is not required for their specific deployment ^[1].

Impact

Successful Exploitation: Provides attackers the capability to create or truncate arbitrary files, which can be further weaponized to achieve Remote Code Execution (RCE) on the server ^[3]^[4].
Business Risk: For internet-facing deployments, this vulnerability represents a critical risk of full system compromise, data theft, or ransomware deployment, given that it allows unauthenticated remote attackers to gain control over the Splunk instance ^[2].

Sources

SVD-2026-0603 | Splunk Vulnerability Disclosure
Alex Hordijk (hordalex) Changelog 2026-06-18: Added: In June 2026, the Splunk Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability. Splunk strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability. 202…
CVE-2026-20253 | Splunk Enterprise Vulnerability | UpGuard
Why this matters CVE-2026-20253 is a critical vulnerability with a CVSS score of 9.8 that allows unauthenticated attackers to perform arbitrary file operations on Splunk Enterprise instances. This flaw is particularly dangerous because it is listed on CISA's Known Exploited Vulnerabilities (KEV) cat…
Resecurity | CVE-2026-20253: Splunk Enterprise Pre-Authentication...
By chaining these weaknesses together, an unauthenticated attacker could progress from exposed administrative functionality to arbitrary file writes and ultimately Remote Code Execution (RCE). The detailed exploitation chain is described in the Attack Flow section.Why This Vulnerability Is Critical.
NVD - CVE-2026-20253
CVE-2026-20253 Detail. Description. In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for…
CVE-2026-20253: Splunk Enterprise RCE & File Operation ...
The vulnerability stems from unsafe deserialization of App Key Value Store (KV Store) data through the jsonpickle Python library, which ... About the Vulnerability: CVE-2026-20253 and Related CVEs. The most severe issue, CVE-2026-20253, originates from a PostgreSQL sidecar service endpoint in Splunk…

🔴 CVE-2026-20253