Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication

Summary: Splunk released fixes for CVE-2026-20253, a 9.8-rated flaw in Splunk Enterprise versions below 10.2.4 and 10.0.7 where an unauthenticated PostgreSQL sidecar endpoint allowed arbitrary file creation and truncation. watchTowr Labs showed the flaw could reach pre-authenticated remote code execution via the /v1/postgres/recovery/backup and restore endpoints, and Splunk PSIRT said on June 18, 2026 it became aware of limited exploitation, prompting CISA to add the flaw to its KEV catalog with a June 21, 2026 remediation deadline for FCEB agencies.
Why it matters: A 9.8 unauthenticated flaw in a log platform that sits inside security operations is now confirmed as exploited in limited cases, and federal agencies have until June 21, 2026 to patch - a deadline your own Splunk estate may already be past.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-20253
Related: CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Jun 18, 2026
⚡ Weekly Recap: Chrome 0-Day, Uni Fi Exploits, macOS Stealers, VPN Flaw and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026