Skip to content
OriginalSign in

CISA

CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches

Part of the CVE-2026-20253 story · since 11 Jun

Quiet for 19 weekslast report 19 Jun8 articles5 outlets
11 Jun · SecurityOnline first24 Aug18 SepNowThis article5th of 8
  • Thu 11 Jun, 04:21 UTC. SecurityOnline, first report. Check Point VPN under attack as Splunk issues urgent patches. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 11:10 UTC. SecurityWeek, its first report on the story. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 19:00 UTC. SecurityOnline. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 22:30 UTC. CISA, its first report on the story. CISA flags critical Splunk flaw enabling unauthenticated file edits. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 23:52 UTC. CISA. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches. Cites a CVE in CISA KEV. This article, 5th of 8.
  • Fri 19 Jun, 04:40 UTC. SecurityWeek. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 11:10 UTC. Security Affairs, its first report on the story. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 15:40 UTC. SOCRadar, its first report on the story. CVE-2026-20253 Splunk bug lets hackers run code remotely. Cites a CVE in CISA KEV.

The CISA's Known Exploited Vulnerabilities (KEV) Catalog serves as a critical resource for the cybersecurity community, providing an authoritative source of vulnerabilities actively exploited in the wild. Organizations are encouraged to use the KEV catalog to enhance their vulnerability management strategies. A current example in the catalog is CVE-2026-20253, a vulnerability in Splunk Enterprise that lacks authentication for a critical function, allowing unauthenticated users to manipulate files.

The catalog also offers various formats for access, including CSV and JSON, and provides links for further information and subscriptions to updates.

How the story developed

All 8 articles
Quiet for 19 weekslast report 19 Jun8 articles5 outlets

8 articles from 5 outlets since 11 Jun. Quiet since 19 Jun. This was the 5th report, 8 days after the first.

Now11 Jun12131415161718192021First reportSecurityOnline · 11 Jun, 04:21This article5th of 8 · day 7
  • Thu 11 Jun, 04:21 UTC. SecurityOnline, first report. Check Point VPN under attack as Splunk issues urgent patches. Cites a CVE in CISA KEV.
  • Thu 11 Jun, 11:10 UTC. SecurityWeek, its first report on the story. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 19:00 UTC. SecurityOnline. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 22:30 UTC. CISA, its first report on the story. CISA flags critical Splunk flaw enabling unauthenticated file edits. Cites a CVE in CISA KEV.
  • Thu 18 Jun, 23:52 UTC. CISA. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches. Cites a CVE in CISA KEV. This article, 5th of 8.
  • Fri 19 Jun, 04:40 UTC. SecurityWeek. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 11:10 UTC. Security Affairs, its first report on the story. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21. Cites a CVE in CISA KEV.
  • Fri 19 Jun, 15:40 UTC. SOCRadar, its first report on the story. CVE-2026-20253 Splunk bug lets hackers run code remotely. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 8 articles as a list
  1. Thu 11 JunDay 02
    1. Check Point VPN under attack as Splunk issues urgent patches04:21 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Palo Alto fixes Cortex flaw: Splunk patches Enterprise bug11:10 · SecurityWeek · Known exploited CVE

  2. Quiet for 7 days

    Thu 18 JunDay 73
    1. Splunk CVE-2026-20253: CVSS 9.8 RCE Exploited in the Wild19:00 · SecurityOnline · Picked up again · Known exploited CVE
    2. CISA flags critical Splunk flaw enabling unauthenticated file edits22:30 · CISA · official · CISA alert · Known exploited CVE
    3. CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches23:52 · CISA · official · Known exploited CVE · This article, 5th of 8
  3. Fri 19 JunDay 83
    1. Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure04:40 · SecurityWeek · Known exploited CVE
    2. CISA adds Splunk flaw CVE-2026-20253, urges patch by June 2111:10 · Security Affairs · Known exploited CVE
    3. CVE-2026-20253 Splunk bug lets hackers run code remotely15:40 · SOCRadar · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in