A critical vulnerability in Splunk Enterprise, identified as CVE-2026-20253, is being actively exploited, prompting urgent patching for affected versions (10.2 < 10.2.4 and 10.0 < 10.0.7). This vulnerability allows unauthenticated attackers to perform file operations via an unprotected PostgreSQL sidecar service. Patches were made available on June 10, and exploitation was confirmed by Splunk on June 18.
CISA has since added this vulnerability to its Known Exploited Vulnerabilities catalog, advising federal agencies to address it by June 21. Organizations are strongly encouraged to upgrade to secure versions of the software.