Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekEduard Kovacs

Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure

Part of the CVE-2026-20253 story · since 11 Jun

Quiet for 19 weekslast report 19 Jun8 articles5 outlets
11 Jun · SecurityOnline first24 Aug18 SepNowThis article6th of 8
  • Thu 11 Jun, 04:21 UTC. SecurityOnline, first report. Check Point VPN under attack as Splunk issues urgent patches. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 11:10 UTC. SecurityWeek, its first report on the story. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 19:00 UTC. SecurityOnline. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 22:30 UTC. CISA, its first report on the story. CISA flags critical Splunk flaw enabling unauthenticated file edits. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 23:52 UTC. CISA. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 04:40 UTC. SecurityWeek. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure. Cites a CVE in CISA KEV. This article, 6th of 8.
  • Fri 19 Jun, 11:10 UTC. Security Affairs, its first report on the story. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 15:40 UTC. SOCRadar, its first report on the story. CVE-2026-20253 Splunk bug lets hackers run code remotely. Cites a CVE in CISA KEV.

A critical vulnerability in Splunk Enterprise, identified as CVE-2026-20253, is being actively exploited, prompting urgent patching for affected versions (10.2 < 10.2.4 and 10.0 < 10.0.7). This vulnerability allows unauthenticated attackers to perform file operations via an unprotected PostgreSQL sidecar service. Patches were made available on June 10, and exploitation was confirmed by Splunk on June 18.

CISA has since added this vulnerability to its Known Exploited Vulnerabilities catalog, advising federal agencies to address it by June 21. Organizations are strongly encouraged to upgrade to secure versions of the software.

How the story developed

All 8 articles
Quiet for 19 weekslast report 19 Jun8 articles5 outlets

8 articles from 5 outlets since 11 Jun. Quiet since 19 Jun. This was the 6th report, 8 days after the first.

Now11 Jun12131415161718192021First reportSecurityOnline · 11 Jun, 04:21This article6th of 8 · day 8
  • Thu 11 Jun, 04:21 UTC. SecurityOnline, first report. Check Point VPN under attack as Splunk issues urgent patches. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 11:10 UTC. SecurityWeek, its first report on the story. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 19:00 UTC. SecurityOnline. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 22:30 UTC. CISA, its first report on the story. CISA flags critical Splunk flaw enabling unauthenticated file edits. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 23:52 UTC. CISA. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 04:40 UTC. SecurityWeek. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure. Cites a CVE in CISA KEV. This article, 6th of 8.
  • Fri 19 Jun, 11:10 UTC. Security Affairs, its first report on the story. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 15:40 UTC. SOCRadar, its first report on the story. CVE-2026-20253 Splunk bug lets hackers run code remotely. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Thu 11 JunDay 02
    1. Check Point VPN under attack as Splunk issues urgent patches04:21 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug11:10 · SecurityWeek · Known exploited CVE

  2. Quiet for 7 days

    Thu 18 JunDay 73
    1. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild19:00 · SecurityOnline · Picked up again · Known exploited CVE
    2. CISA flags critical Splunk flaw enabling unauthenticated file edits22:30 · CISA · official · CISA alert · Known exploited CVE
    3. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches23:52 · CISA · official · Known exploited CVE
  3. Fri 19 JunDay 83
    1. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure04:40 · SecurityWeek · Known exploited CVE · This article, 6th of 8
    2. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 2111:10 · Security Affairs · Known exploited CVE
    3. CVE-2026-20253 Splunk bug lets hackers run code remotely15:40 · SOCRadar · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in