The Hacker Newsinfo@thehackernews.com (The Hacker News)
Critical Splunk flaw lets attackers run code without auth
Part of the Splunk story · since 11 Jun
Quiet for 19 weekslast report 19 Jun12 articles6 outlets
- Thu 11 Jun, 04:21 UTC. SecurityOnline, first report. Check Point VPN under attack as Splunk issues urgent patches. Cites a CVE in CISA KEV.
- Thu 11 Jun, 11:10 UTC. SecurityWeek, its first report on the story. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug.
- Sat 13 Jun, 14:18 UTC. The Hacker News, its first report on the story. Critical Splunk flaw lets attackers run code without auth. This article, 3rd of 12.
- Wed 17 Jun, 20:12 UTC. SecurityOnline. Splunk AI Toolkit flaw allows arbitrary command execution.
- Thu 18 Jun, 11:11 UTC. SecurityWeek. Atlassian, Splunk release patches for critical AI Toolkit flaw.
- Thu 18 Jun, 19:00 UTC. SecurityOnline. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild. Cites a CVE in CISA KEV.
- Thu 18 Jun, 22:30 UTC. CISA, its first report on the story. CISA flags critical Splunk flaw enabling unauthenticated file edits. Cites a CVE in CISA KEV.
- Thu 18 Jun, 23:52 UTC. CISA. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches. Cites a CVE in CISA KEV.
- Fri 19 Jun, 04:40 UTC. SecurityWeek. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure. Cites a CVE in CISA KEV.
- Fri 19 Jun, 07:27 UTC. SecurityWeek. Cisco acquires WideField Security to strengthen Splunk’s Agentic SOC.
- Fri 19 Jun, 11:10 UTC. Security Affairs, its first report on the story. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21. Cites a CVE in CISA KEV.
- Fri 19 Jun, 15:40 UTC. SOCRadar, its first report on the story. CVE-2026-20253 Splunk bug lets hackers run code remotely. Cites a CVE in CISA KEV.
The article reports a critical vulnerability in Splunk Enterprise that allows attackers to execute code without authentication. This flaw poses a significant risk for organizations using the software, as it can lead to unauthorized access and control over systems. Security measures and updates are urged to mitigate potential exploits stemming from this vulnerability. The article emphasizes the urgency for users to address this issue promptly to protect sensitive data and maintain system integrity.
How the story developed
Quiet for 19 weekslast report 19 Jun12 articles6 outlets
12 articles from 6 outlets since 11 Jun. Quiet since 19 Jun. This was the 3rd report, 2 days after the first.
- Thu 11 Jun, 04:21 UTC. SecurityOnline, first report. Check Point VPN under attack as Splunk issues urgent patches. Cites a CVE in CISA KEV.
- Thu 11 Jun, 11:10 UTC. SecurityWeek, its first report on the story. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug.
- Sat 13 Jun, 14:18 UTC. The Hacker News, its first report on the story. Critical Splunk flaw lets attackers run code without auth. This article, 3rd of 12.
- Wed 17 Jun, 20:12 UTC. SecurityOnline. Splunk AI Toolkit flaw allows arbitrary command execution.
- Thu 18 Jun, 11:11 UTC. SecurityWeek. Atlassian, Splunk release patches for critical AI Toolkit flaw.
- Thu 18 Jun, 19:00 UTC. SecurityOnline. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild. Cites a CVE in CISA KEV.
- Thu 18 Jun, 22:30 UTC. CISA, its first report on the story. CISA flags critical Splunk flaw enabling unauthenticated file edits. Cites a CVE in CISA KEV.
- Thu 18 Jun, 23:52 UTC. CISA. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches. Cites a CVE in CISA KEV.
- Fri 19 Jun, 04:40 UTC. SecurityWeek. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure. Cites a CVE in CISA KEV.
- Fri 19 Jun, 07:27 UTC. SecurityWeek. Cisco acquires WideField Security to strengthen Splunk’s Agentic SOC.
- Fri 19 Jun, 11:10 UTC. Security Affairs, its first report on the story. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21. Cites a CVE in CISA KEV.
- Fri 19 Jun, 15:40 UTC. SOCRadar, its first report on the story. CVE-2026-20253 Splunk bug lets hackers run code remotely. Cites a CVE in CISA KEV.
- Known exploited CVE
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 12 articles as a listHide the list
- Thu 11 JunDay 02
- Check Point VPN under attack as Splunk issues urgent patches04:21 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
- Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug11:10 · SecurityWeek
Quiet for 2 days
Sat 13 JunDay 21- Critical Splunk flaw lets attackers run code without auth14:18 · The Hacker News · Picked up again · This article, 3rd of 12
Quiet for 4 days
Wed 17 JunDay 61- Splunk AI Toolkit flaw allows arbitrary command execution20:12 · SecurityOnline · Picked up again
- Thu 18 JunDay 74
- Atlassian, Splunk release patches for critical AI Toolkit flaw11:11 · SecurityWeek
- Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild19:00 · SecurityOnline · Known exploited CVE
- CISA flags critical Splunk flaw enabling unauthenticated file edits22:30 · CISA · official · CISA alert · Known exploited CVE
- CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches23:52 · CISA · official · Known exploited CVE
- Fri 19 JunDay 84
- Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure04:40 · SecurityWeek · Known exploited CVE
- Cisco acquires WideField Security to strengthen Splunk’s Agentic SOC07:27 · SecurityWeek
- CISA adds Splunk flaw CVE-2026-20253, urges patch by June 2111:10 · Security Affairs · Known exploited CVE