Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21

Part of the CVE-2026-20253 story · since 11 Jun

Quiet for 19 weekslast report 19 Jun8 articles5 outlets
11 Jun · SecurityOnline first24 Aug18 SepNowThis article7th of 8
  • Thu 11 Jun, 04:21 UTC. SecurityOnline, first report. Check Point VPN under attack as Splunk issues urgent patches. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 11:10 UTC. SecurityWeek, its first report on the story. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 19:00 UTC. SecurityOnline. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 22:30 UTC. CISA, its first report on the story. CISA flags critical Splunk flaw enabling unauthenticated file edits. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 23:52 UTC. CISA. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 04:40 UTC. SecurityWeek. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 11:10 UTC. Security Affairs, its first report on the story. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21. Cites a CVE in CISA KEV. This article, 7th of 8.
  • Fri 19 Jun, 15:40 UTC. SOCRadar, its first report on the story. CVE-2026-20253 Splunk bug lets hackers run code remotely. Cites a CVE in CISA KEV.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a severe flaw, CVE-2026-20253, in Splunk Enterprise to its Known Exploited Vulnerabilities catalog. This flaw, which has a CVSS score of 9.8, stems from improper authentication on the PostgreSQL sidecar service, allowing unauthenticated attackers to manipulate files on vulnerable systems. The flaw affects Splunk Enterprise versions 10.2 below 10.2.4 and 10.0 below 10.0.7.

CISA has mandated that federal agencies address this vulnerability by June 21, 2026, while Splunk recommends upgrading to patched versions to mitigate risks. Organizations unable to update should disable the PostgreSQL sidecar service as a temporary measure.

How the story developed

All 8 articles
Quiet for 19 weekslast report 19 Jun8 articles5 outlets

8 articles from 5 outlets since 11 Jun. Quiet since 19 Jun. This was the 7th report, 8 days after the first.

Now11 Jun12131415161718192021First reportSecurityOnline · 11 Jun, 04:21This article7th of 8 · day 8CISA alert18 Jun, 22:30 · official
  • Thu 11 Jun, 04:21 UTC. SecurityOnline, first report. Check Point VPN under attack as Splunk issues urgent patches. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 11:10 UTC. SecurityWeek, its first report on the story. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 19:00 UTC. SecurityOnline. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 22:30 UTC. CISA, its first report on the story. CISA flags critical Splunk flaw enabling unauthenticated file edits. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 23:52 UTC. CISA. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 04:40 UTC. SecurityWeek. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 11:10 UTC. Security Affairs, its first report on the story. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21. Cites a CVE in CISA KEV. This article, 7th of 8.
  • Fri 19 Jun, 15:40 UTC. SOCRadar, its first report on the story. CVE-2026-20253 Splunk bug lets hackers run code remotely. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Thu 11 JunDay 02
    1. Check Point VPN under attack as Splunk issues urgent patches04:21 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug11:10 · SecurityWeek · Known exploited CVE

  2. Quiet for 7 days

    Thu 18 JunDay 73
    1. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild19:00 · SecurityOnline · Picked up again · Known exploited CVE
    2. CISA flags critical Splunk flaw enabling unauthenticated file edits22:30 · CISA · official · CISA alert · Known exploited CVE
    3. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches23:52 · CISA · official · Known exploited CVE
  3. Fri 19 JunDay 83
    1. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure04:40 · SecurityWeek · Known exploited CVE
    2. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 2111:10 · Security Affairs · Known exploited CVE · This article, 7th of 8
    3. CVE-2026-20253 Splunk bug lets hackers run code remotely15:40 · SOCRadar · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in