A critical Splunk Enterprise vulnerability is being exploited in attacks only days after its public disclosure, and organizations have been urged to patch it immediately.
The vulnerability is tracked as CVE-2026-20253 and Splunk’s advisory says it can be exploited by an unauthenticated attacker to create or truncate arbitrary files via a PostgreSQL sidecar service endpoint.
“The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials,” Splunk said in its advisory.
The security hole affects Splunk Enterprise versions 10.2 before 10.2.4 and 10.0 before 10.0.7. Cisco-owned Splunk announced the availability of patches on June 10.
Two days after its disclosure, researchers at cybersecurity firm WatchTowr demonstrated how CVE-2026-20253 can be exploited by an unauthenticated attacker for remote code execution, publishing technical details and PoC code.
Exploitation of the vulnerability was confirmed by Splunk on June 18.
“In June 2026, the Splunk Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability,” Splunk said. “Splunk strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.”
There does not appear to be any publicly available information about the attacks involving CVE-2026-20253, but many enterprises may be at risk.
CISA added CVE-2026-20253 to its Known Exploited Vulnerabilities (KEV) catalog on June 18 and instructed federal agencies to address it by June 21. This is the first Splunk flaw added to CISA’s KEV list.
Related: Atlassian, Splunk Patch Critical Vulnerabilities
Related: Majority of Internet-Accessible REDCap Servers Outdated
Related: F5 Patches Critical, High-Severity NGINX Vulnerabilities
Related: Critical Command Execution Vulnerability Patched in Cisco ISE
