CVE-2026-20253Active Exploitation(splunk / splunk)

CRITICALCVSS 9.8 · CRITICALCISA KEV

Exploitation observed; activity peaked at 32 mentions and remains active

Immediate actions

Patch splunk splunk systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.

splunk CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-06-21. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Exploit / PoC references

https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/

Vendor / third-party advisories

https://advisory.splunk.com/advisories/SVD-2026-0603

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20253

Weakness type (CWE)

CWE-306

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

splunk

Threat summary

Active exploitation appears in 96 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
228 mentions across 40 observed days

What's happening

Active exploitation reported across 96 signals
Exploit tool or code specified in 15 signals
PoC mentioned or linked in 34 signals
Patch or workaround mentioned in 79 signals
Technical details provided in 174 signals
Disclosure: 63 classified signals
General: 28 classified signals
Peaked 30d ago at 32 mentions (2026-06-19); latest day: 1
228 total mentions across 40 days

Affected systems

Vendors

splunk

Products

splunk

Deep dive

Activity timeline228 mentions / 40d

Signal classification7 categories

Active Exploitation

9139.9%

Disclosure

6327.6%

General

2812.3%

Patch

2711.8%

PoC

125.3%

Exploit

62.6%

Referenced assets132 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-10	2	Disclosure1Patch1
2026-06-11	6	Disclosure4General1Patch1
2026-06-12	6	Disclosure1Patch2PoC3
2026-06-13	21	Active Exploitation2Disclosure7Exploit1General4Patch5PoC2
2026-06-14	23	Active Exploitation4Disclosure10Exploit2General2Patch2PoC3
2026-06-15	18	Active Exploitation3Disclosure8General3Patch4
2026-06-16	4	Active Exploitation1Disclosure1General2
2026-06-17	8	Active Exploitation1Disclosure2Patch3PoC2
2026-06-18	5	Active Exploitation5
2026-06-19	32	Active Exploitation26Disclosure3General1Patch2
2026-06-20	15	Active Exploitation10Disclosure1General4
2026-06-21	13	Active Exploitation8Disclosure1General2Patch1PoC1
2026-06-22	16	Active Exploitation12Disclosure1General1Patch2
2026-06-23	4	Active Exploitation3Disclosure1
2026-06-24	2	Active Exploitation2
2026-06-25	1	PoC1
2026-06-26	4	Active Exploitation2Disclosure1General1
2026-06-27	1	Disclosure1
2026-06-28	2	Patch2
2026-06-29	1	Disclosure1
2026-07-01	2	Active Exploitation1General1
2026-07-02	1	Patch1
2026-07-03	1	General1
2026-07-06	1	Disclosure1
2026-07-07	1	Active Exploitation1
2026-07-08	3	Disclosure2General1
2026-07-09	7	Active Exploitation2Disclosure5
2026-07-10	7	Active Exploitation1Disclosure4Exploit1General1
2026-07-12	5	Active Exploitation4Disclosure1
2026-07-13	2	General2
2026-07-14	1	Active Exploitation1
2026-07-15	1	Active Exploitation1
2026-07-20	1	Patch1
2026-07-22	1	Exploit1
2026-08-02	1	Active Exploitation1
2026-08-19	4	Disclosure2Disclosures1General1
2026-08-25	1	Disclosure1
2026-09-11	2	Disclosure1Exploit1
2026-09-18	1	Disclosure1
2026-10-22	1	Disclosure1

Full discourse20 posts

International Cyber Digest@IntCyberDigest135d
PoC
🚨 BrEaKiNg: Splunk, a security product, has zero authentication in its built-in database service and accepts any credentials, according to the security researchers who just dropped a full pre-auth RCE chain for Splunk Enterprise (CVE-2026-20253, CVSS 9.8). Splunk Enterprise on AWS is vulnerable out of the box.
Post summary
Security researchers have publicly released a full pre‑authentication RCE chain for Splunk Enterprise (CVE‑2026‑20253), highlighting a zero‑auth flaw in its database service and a high CVSS score of 9.8.
21207221.3K392116.1K
202.6K followersView on X
The Hacker News@TheHackersNews134d
Disclosure
🚨 ALERT - A critical Splunk Enterprise flaw can go from “no login required” to remote code execution. Tracked as CVE-2026-20253, the bug carries a 9.8 CVSS score and affects vulnerable Splunk Enterprise servers through exposed PostgreSQL sidecar endpoints. The exploit chain is now public. Read the full story: https://thehackernews.com/2026/06/critical-splunk-enterprise-flaw-lets.html
Post summary
A critical Splunk Enterprise vulnerability (CVE‑2026‑20253) with a 9.8 CVSS score is disclosed, exposing remote code execution via PostgreSQL sidecar endpoints; the exploit chain is publicly available.
712833569742.8K
2.0M followersView on X
watchTowr@watchtowrcyber135d
PoC
Happy Friday... again. Yes, we've been left unattended, allowing us to run amok and publish our analysis of CVE-2026-20253 - an Arbitrary File Write in Splunk Enterprise that can be turned into Pre-Auth RCE... Enjoy, friends! https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce
Post summary
The post announces a new Splunk Enterprise vulnerability (CVE‑2026‑20253) that allows arbitrary file writes and can lead to pre‑authentication RCE, and links to a proof‑of‑concept, but provides no evidence of active exploitation or patch advice.
13911104112.5K
12.3K followersView on X
The Hacker News@TheHackersNews128d
Active Exploitation
This Splunk flaw is no longer just theoretical. Splunk says it is aware of limited exploitation of CVE-2026-20253. CISA has added it to KEV, giving federal agencies until June 21, 2026 to patch. Upgrade now. Read the update: https://thehackernews.com/2026/06/critical-splunk-enterprise-flaw-lets.html
Post summary
Splunk CVE-2026-20253 is being exploited in the wild, with CISA demanding patching by June 21, 2026; no PoC or exploit code is disclosed in the text.
53631111618.1K
2.2M followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi132d
Disclosure
🚨 تستخدم Splunk Enterprise؟ حدّث الآن، تم اكتشاف لثغرة CVE-2026-20253 تقييمها 9.8 Critical، وتسمح لمهاجم بدون تسجيل دخول بإنشاء ملفات أو تصفير محتوى ملفات على السيرفر عبر PostgreSQL Sidecar Service Endpoint. https://t.co/Pbw1hEsnP1
Post summary
The tweet announces a critical CVE‑2026‑20253 affecting Splunk Enterprise, stating it enables unauthenticated file creation and deletion via the PostgreSQL Sidecar Service, but provides no exploit code or patch information.
23050215.4K
50.1K followersView on X
🏴‍☠️ The Pirate 🏴‍☠️@Pinperepette134d
Disclosure
ok è sabato, quindi guardiamo la vulnerabilità più interessante della settimana 😂. Secondo me vince la CVE-2026-20253 di Splunk (CVSS 9.8). Un endpoint PostgreSQL esposto senza autenticazione permette a un attaccante remoto di creare o modificare file sul server. Quando il bersaglio è uno dei SIEM più diffusi nelle grandi aziende,stai colpendo proprio il sistema incaricato di vedere gli attacchi. https://advisory.splunk.com/advisories/SVD-2026-0603
Post summary
The post announces Splunk CVE‑2026‑20253, describing an unauthenticated PostgreSQL endpoint that could let attackers create or modify server files, without providing a PoC, exploit package, or patch details.
5404774.9K
18.6K followersView on X
CISA Cyber@CISACyber129d
Active Exploitation
🛡️ We added Splunk Enterprise missing authentication for critical function vulnerability CVE-2026-20253 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/jhJnQuKp49
Post summary
CVE-2026-20253 is identified as a known exploited vulnerability in the DHS KEV catalog, with the post recommending mitigation steps while no PoC or exploit code is shared.
41453509.5K
301.2K followersView on X
FOFA@fofabot132d
Disclosure
⚠️⚠️ CVE-2026-20253 (CVSS 9.8): Unauthenticated file create/truncate via Splunk Enterprise PostgreSQL sidecar endpoint. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJzcGx1bmstRW50ZXJwcmlzZSI= 🎯94K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="splunk-Enterprise" Deep Dive: https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/ 🔖Refer: https://advisory.splunk.com/advisories/SVD-2026-0603 #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The post announces Splunk Enterprise CVE‑2026‑20253 with a high CVSS score and describes the unauthenticated file create/truncate vulnerability, linking to FOFA data and a detailed analytical article, but does not provide PoC code, exploitable tools, or evidence of active attacks.
111036103.7K
14.6K followersView on X
Miggo Security@MiggoSecurity110d
Active Exploitation
Splunk, the platform built to catch attackers, can now be hijacked by them. CVE-2026-20253: Unauthenticated. No credentials. Execute code as the Splunk service account, then tamper with the logs and alerts your team relies on to detect the attack. CISA added this to KEV 8 days after disclosure. Exploitation confirmed within days of a public PoC. Miggo found additional RCE paths beyond the public PoC. Two layers of defense: a validated WAF Copilot rule at the edge, and a runtime sensor catching the behavioral signature in the workload, even if something slips past the perimeter. When the watcher goes blind, you need something watching the watcher. https://www.miggo.io/post/blind-the-watcher-stopping-the-unauthenticated-splunk-rce-cve-2026-20253-before-the-patch-lands
Post summary
The post announces CVE-2026-20253 as actively exploited, with publicly available PoC code and additional RCE paths identified by Miggo, and highlights the need for monitoring while awaiting a vendor patch.
24131183.5K
141 followersView on X
hiro_@papa_anniekey126d
General
FeedlyのThreat Intelligenceの機能、時系列等を整理するのにめっちゃ便利！だよね。かなりおすすめ。 https://feedly.com/cve/CVE-2026-20253
Post summary
The text promotes using Feedly’s Threat Intelligence feature to browse or organize information on CVE-2026-20253, but provides no technical or exploit details.
02027223.0K
8.1K followersView on X
International Cyber Digest@IntCyberDigest135d
Disclosure
Source: https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/
Post summary
The link points to an article describing Splunk Enterprise CVE‑2026‑20253 as a pre‑authentication RCE; no PoC, exploit, or remediation details are explicitly mentioned.
130321010.3K
202.6K followersView on X
SOCRadar®@socradar128d
Active Exploitation
Splunk admins, your weekend might be starting early (and not in a good way). 🚨 CVE-2026-20253 just hit the CISA KEV list with confirmed active exploitation. 🔹 CVSS 9.8 🔹 Unauthenticated file write/truncate flaw 🔹 Public exploit chain leading to RCE Patch to 10.0.7 or 10.2.4 immediately to mitigate the risk. Don't wait on this one. 👇 🔗 https://hubs.la/Q04m0-KP0 #CyberSecurity #Splunk #KEV #RCE #ThreatIntel #SOCRadar
Post summary
Splunk vulnerability CVE-2026-20253 is actively exploited with high severity (CVSS 9.8) and requires immediate patching to versions 10.0.7 or 10.2.4.
4802383.0K
6.6K followersView on X
Ryan Dewhurst@ethicalhack3r131d
Active Exploitation
🚨 CVE-2026-20253 is not yet in CISA KEV. But KEVIntel honeypots are already seeing sustained attacker activity targeting Splunk Enterprise. - 80 exploitation attempts - 17 attacker IPs - 8 countries If Splunk is exposed in your environment, this should be on the radar. Full telemetry in the comment reply.
Post summary
The post reports real‑world attack activity against Splunk Enterprise via CVE‑2026‑20253, witnessed by 80 exploitation attempts in honeypot data, though the CVE is not yet listed in the CISA KEV database.
2742179.5K
21.2K followersView on X
ボス@サイバーセキュリティの専門家@boss_sec_labo133d
Active Exploitation
AIを使う側が、狙われる番に回った。開発を支えるAIツールと暗号・監視の土台が同じ日に穴を突かれ、足元の国内では教育と子どもの情報が漏れた。・OpenSSLにCVE-2026-45447、解放後使用の高危険度脆弱性をClaudeが発見・AIコーディング支援を騙すAgentjacking、Sentry偽エラーで任意コード実行・Langflow CVE-2026-5027、Path Traversalで任意ファイル書き込みを悪用・Splunk Enterprise CVE-2026-20253、CVSS 9.8の未認証RCE ・Oracle PeopleSoft CVE-2026-35273、CISAがKEV追加で悪用確認・The Gentlemenランサム、AI支援RaaSで478被害を主張・学習塾CKCネットワーク・学参がランサム被害、個人情報漏えいの恐れ・日本大学文理学部サイトが改ざん、カジノサイトへ誘導・写真販売「はいチーズ！フォト」不正アクセス、子どもの情報漏えいの可能性守る道具まで乗っ取られる時代だ。君の現場で今日最初に当てるパッチは決まったか？ "後でいい"は、攻撃者への贈り物だ。
Post summary
The post enumerates several newly disclosed CVEs, noting that Oracle PeopleSoft CVE‑2026‑35273 has been confirmed for exploitation in the wild per CISA, but it does not provide any PoC or exploit code.
03027103.8K
1.5K followersView on X
elhacker.NET@elhackernet136d
Disclosure
Vulnerabilidades en Splunk Enterprise permiten ejecutar scripts maliciosos CVE-2026-20253, posee una puntuación CVSS de 9.8 y afecta a las versiones inferiores a la 10.2.4 https://blog.elhacker.net/2026/06/vulnerabilidades-en-splunk-enterprise.html
Post summary
El artículo anuncia la vulnerabilidad CVE-2026-20253 en Splunk Enterprise, indicando un riesgo crítico (CVSS 9.8) para versiones menores a 10.2.4, sin reportar exploit disponible, uso activo, ni soluciones propuestas.
01202072.3K
141.0K followersView on X
YogSotho@YogSoth0132d
General
**CVE-2026-20253 Splunk Exploit Kit **CVE-2026-20253 — Splunk Enterprise/Cloud PostgreSQL Sidecar Service** **Unauthenticated Arbitrary File Creation/Truncation → Full RCE** **Military-Grade Multi-Stage Exploitation via pg_dump/pg_restore Chain** #exploit #0days #CVE #CVSS #security #hacking
Post summary
The post announces CVE‑2026‑20253 with technical details of the vulnerability and a potential multi‑stage exploitation chain but provides no evidence of active exploitation, patches, or proof‑of‑concept code.
0212671.8K
1.8K followersView on X
rootsecdev@rootsecdev134d
Disclosure
Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE) https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/
Post summary
An article announces a pre-authentication Remote Code Execution vulnerability in Splunk Enterprise (CVE-2026-20253), providing the CVE identifier and a brief technical description, but no proof-of-concept, exploit code, active exploitation evidence, or patch details.
11023102.2K
26.8K followersView on X
NetSPI@NetSPI132d
Patch
PATCH NOW! CVE-2026-20253 Splunk Enterprise Unauthenticated Arbitrary File Operations / RCE. This vulnerability allows any network-reachable attacker to create or overwrite files on the server without credentials. Immediate action is necessary: https://ow.ly/ijNi50ZbY5n https://t.co/ap818zKly4
Post summary
The post urges immediate patching of Splunk Enterprise for CVE-2026-20253, an unauthenticated RCE that allows attackers to create or overwrite files.
1801532.4K
4.1K followersView on X
watchTowr@watchtowrcyber107d
Disclosure
Rapid reaction gets you ahead. 7 days before CISA added CVE-2026-20253 a critical Unauthenticated Arbitrary File Creation vulnerability (CVSS 9.8) in Splunk Enterprise to KEV, watchTowr clients were aware of their exposure. Reach out via our website if you need support. https://t.co/PEccnh9Gax
Post summary
The post announces that watchTowr clients were aware of the CVE‑2026‑20253 vulnerability in Splunk Enterprise before it entered CISA’s KEV, but it offers no PoC, exploit code, patch, or evidence of active exploitation.
0601643.0K
12.6K followersView on X
mRr3b00t@UK_Daniel_Card134d
Disclosure
CVE-2026-20253 CVE-2026-20253 is a critical vulnerability (CVSS 9.8) in Splunk Enterprise and Splunk Cloud Platform. Summary An unauthenticated attacker who can reach the affected service can create or truncate arbitrary files on the system via a PostgreSQL sidecar service endpoint that lacks proper authentication controls (CWE-306). This can lead to data destruction, service disruption, privilege escalation, or remote code execution (RCE) by overwriting sensitive files or configurations. Affected Versions Splunk Enterprise: Versions below 10.2.4 and below 10.0.7 Splunk Cloud Platform: Versions below 10.4.2604.3 and below 10.2.2510.14 Fixed in: Splunk Enterprise 10.2.4, 10.0.7 (and later) Corresponding Splunk Cloud Platform releases. Technical Details The flaw stems from the PostgreSQL sidecar service endpoint (e.g., paths like /v1/postgres/recovery/backup and /v1/postgres/recovery/restore) not requiring any authentication. Network-reachable attackers can invoke file operations directly. It is particularly notable in Splunk Enterprise on AWS deployments where the sidecar is enabled by default. Impact and Exploitation Unauthenticated remote file write/truncation → High risk of full compromise. Researchers (e.g., watchTowr Labs) have published technical details and proof-of-concept information demonstrating pre-auth RCE potential. Disclosed around June 10, 2026, alongside related high-severity issues in Splunk. Mitigation Upgrade immediately to a fixed version. Restrict network access to Splunk instances (e.g., firewall rules, avoid exposing management ports publicly). Monitor for suspicious activity on PostgreSQL sidecar endpoints. Apply any additional guidance from Splunk's official advisory (SVD-2026-0603). FIf you're running Splunk, check your version and patch ASAP — this is considered easily exploitable. #byGROK
Post summary
A newly disclosed critical vulnerability (CVSS 9.8) in Splunk Enterprise and Cloud allows unauthenticated attackers to create or truncate arbitrary files via a PostgreSQL sidecar service, with PoC details released and patches immediately available. Splunk urges users to upgrade or restrict network access to prevent potential RCE or data destruction.
3201732.1K
124.4K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	splunk	splunk	-	-	-

Explore more

Back to dashboard splunk CVEs splunk vulnerabilities

What researchers are saying

CVE-2026-20253

International Cyber Digest[verified]@IntCyberDigestPoC

Security researchers have publicly released a full pre‑authentication RCE chain for Splunk Enterprise (CVE‑2026‑20253), highlighting a zero‑auth flaw in its database service and a high CVSS score of 9.8.

watchTowr[verified]@watchtowrcyberPoC

The post announces a new Splunk Enterprise vulnerability (CVE‑2026‑20253) that allows arbitrary file writes and can lead to pre‑authentication RCE, and links to a proof‑of‑concept, but provides no evidence of active exploitation or patch advice.

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediDisclosure

The tweet announces a critical CVE‑2026‑20253 affecting Splunk Enterprise, stating it enables unauthenticated file creation and deletion via the PostgreSQL Sidecar Service, but provides no exploit code or patch information.

🏴‍☠️ The Pirate 🏴‍☠️[verified]@PinperepetteDisclosure

The post announces Splunk CVE‑2026‑20253, describing an unauthenticated PostgreSQL endpoint that could let attackers create or modify server files, without providing a PoC, exploit package, or patch details.

FOFA[verified]@fofabotDisclosure

The post announces Splunk Enterprise CVE‑2026‑20253 with a high CVSS score and describes the unauthenticated file create/truncate vulnerability, linking to FOFA data and a detailed analytical article, but does not provide PoC code, exploitable tools, or evidence of active attacks.

Miggo Security[verified]@MiggoSecurityActive Exploitation

The post announces CVE-2026-20253 as actively exploited, with publicly available PoC code and additional RCE paths identified by Miggo, and highlights the need for monitoring while awaiting a vendor patch.

International Cyber Digest[verified]@IntCyberDigestDisclosure

The link points to an article describing Splunk Enterprise CVE‑2026‑20253 as a pre‑authentication RCE; no PoC, exploit, or remediation details are explicitly mentioned.

SOCRadar®[verified]@socradarActive Exploitation

Splunk vulnerability CVE-2026-20253 is actively exploited with high severity (CVSS 9.8) and requires immediate patching to versions 10.0.7 or 10.2.4.