Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure
Vulnerabilities
CISA has given federal agencies only three days to patch CVE-2026-20253, which can be exploited for unauthenticated remote code execution.
A critical Splunk Enterprise vulnerability is being exploited in attacks only days after its public disclosure, and organizations have been urged to patch it immediately.
The vulnerability is tracked as CVE-2026-20253 and Splunk’s advisory says it can be exploited by an unauthenticated attacker to create or truncate arbitrary files via a PostgreSQL sidecar service endpoint.
“The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials,” Splunk said in its advisory.
The security hole affects Splunk Enterprise versions 10.2 before 10.2.4 and 10.0 before 10.0.7. Cisco-owned Splunk announced the availability of patches on June 10.
Two days after its disclosure, researchers at cybersecurity firm WatchTowr demonstratedhow CVE-2026-20253 can be exploited by an unauthenticated attacker for remote code...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
