Skip to content
OriginalSign in
Image: SOCRadar

SOCRadarYağmur Ernalbant

CVE-2026-20253 Splunk bug lets hackers run code remotely

Part of the CVE-2026-20253 story · since 11 Jun

Quiet for 19 weekslast report 19 Jun8 articles5 outlets
11 Jun · SecurityOnline first24 Aug18 SepNowThis article8th of 8
  • Thu 11 Jun, 04:21 UTC. SecurityOnline, first report. Check Point VPN under attack as Splunk issues urgent patches. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 11:10 UTC. SecurityWeek, its first report on the story. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 19:00 UTC. SecurityOnline. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 22:30 UTC. CISA, its first report on the story. CISA flags critical Splunk flaw enabling unauthenticated file edits. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 23:52 UTC. CISA. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 04:40 UTC. SecurityWeek. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 11:10 UTC. Security Affairs, its first report on the story. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 15:40 UTC. SOCRadar, its first report on the story. CVE-2026-20253 Splunk bug lets hackers run code remotely. Cites a CVE in CISA KEV. This article, 8th of 8.

CVE-2026-20253 is a critical vulnerability in Splunk Enterprise that allows unauthenticated attackers to perform arbitrary file operations, potentially leading to remote code execution (RCE). CISA warns of active exploitation and has listed this vulnerability in their Known Exploited Vulnerabilities catalog. Affected versions include Splunk Enterprise 10.0.0 to 10.0.6 and 10.2.0 to 10.2.3, with patches in 10.0.7 and 10.2.4.

The vulnerability stems from a flaw in the PostgreSQL sidecar service endpoint, which lacks authentication. Organizations should urgently apply patches, disable the vulnerable service if necessary, and improve network segmentation to mitigate risk. Monitoring for unusual file operations on affected systems is also recommended.

How the story developed

All 8 articles
Quiet for 19 weekslast report 19 Jun8 articles5 outlets

8 articles from 5 outlets since 11 Jun. Quiet since 19 Jun. This was the 8th report, 8 days after the first.

Now11 Jun12131415161718192021First reportSecurityOnline · 11 Jun, 04:21This article8th of 8 · day 8CISA alert18 Jun, 22:30 · official
  • Thu 11 Jun, 04:21 UTC. SecurityOnline, first report. Check Point VPN under attack as Splunk issues urgent patches. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 11:10 UTC. SecurityWeek, its first report on the story. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 19:00 UTC. SecurityOnline. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 22:30 UTC. CISA, its first report on the story. CISA flags critical Splunk flaw enabling unauthenticated file edits. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 23:52 UTC. CISA. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 04:40 UTC. SecurityWeek. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 11:10 UTC. Security Affairs, its first report on the story. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 15:40 UTC. SOCRadar, its first report on the story. CVE-2026-20253 Splunk bug lets hackers run code remotely. Cites a CVE in CISA KEV. This article, 8th of 8.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Thu 11 JunDay 02
    1. Check Point VPN under attack as Splunk issues urgent patches04:21 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug11:10 · SecurityWeek · Known exploited CVE

  2. Quiet for 7 days

    Thu 18 JunDay 73
    1. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild19:00 · SecurityOnline · Picked up again · Known exploited CVE
    2. CISA flags critical Splunk flaw enabling unauthenticated file edits22:30 · CISA · official · CISA alert · Known exploited CVE
    3. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches23:52 · CISA · official · Known exploited CVE
  3. Fri 19 JunDay 83
    1. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure04:40 · SecurityWeek · Known exploited CVE
    2. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 2111:10 · Security Affairs · Known exploited CVE
    3. CVE-2026-20253 Splunk bug lets hackers run code remotely15:40 · SOCRadar · Known exploited CVE · This article, 8th of 8

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in