Splunk Enterprise CVE-2026-20253: CISA KEV Alert Orders Federal Patch by Sunday

CISA has added a critical Splunk Enterprise vulnerability to its Known Exploited Vulnerabilities catalog after threat actors began actively exploiting it in the wild. Tracked as CVE-2026-20253, the flaw allows unauthenticated remote attackers to create or truncate arbitrary files on vulnerable systems, leading to full remote code execution. The agency has ordered Federal Civilian Executive Branch agencies to patch by Sunday under a new binding directive.

What Happened: Unauthenticated File Creation Flaw in Splunk Enterprise Under Active Exploit

On June 10, 2026, Splunk published advisory SVD-2026-0603 detailing a critical vulnerability in Splunk Enterprise. The flaw exists in the PostgreSQL sidecar service endpoint, which lacks authentication controls. Consequently, any network-reachable attacker can invoke file operations without credentials.

On June 12, security researchers at WatchTowr published a technical write-up and proof-of-concept exploit code. Furthermore, they demonstrated that the vulnerability can be chained into full remote code execution. On June 18, Splunk updated its advisory to confirm limited exploitation in the wild. The same day, CISA added CVE-2026-20253 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by June 21, 2026.

This timeline from disclosure to confirmed exploitation took just eight days, underscoring the urgency of rapid patch deployment for internet-facing infrastructure.

Technical Details of CVE-2026-20253

CVE-2026-20253 is an unauthenticated arbitrary file creation and truncation vulnerability in the PostgreSQL sidecar service of Splunk Enterprise. The affected versions are Splunk Enterprise 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6. Splunk Enterprise versions 9.4 and earlier are not affected.

Attack Vector and Prerequisites

• Network access to the PostgreSQL sidecar service endpoint
• A vulnerable Splunk Enterprise instance running affected versions
• No authentication or privileges required

Exploitation Mechanics

The PostgreSQL sidecar service endpoint accepts requests without verifying credentials. Therefore, an attacker can create or truncate arbitrary files on the underlying filesystem. WatchTowr researchers demonstrated that this primitive can be escalated to remote code execution. Splunk has rated the vulnerability CVSS 9.8 Critical.

Exploited in the Wild

Splunk Product Security Incident Response Team confirmed limited exploitation in June 2026. Additionally, Shadowserver Foundation tracks over 1,400 internet-exposed Splunk instances globally, with 952 located in North America and 223 in Europe. However, the exact number of vulnerable instances remains unknown.

Business and Operational Impact

The impact of this vulnerability extends beyond Splunk deployments to any organization relying on the platform for security monitoring and incident response. If an attacker gains code execution on a Splunk indexer or search head, they can tamper with logs, disable alerts, or pivot deeper into the network.

Immediate Risks

• Data integrity loss: Attackers can create or overwrite critical files, including configuration and log data
• SIEM blindness: Compromised Splunk instances may stop forwarding or accurately reporting security events
• Lateral movement: A compromised Splunk server often holds credentials or API tokens for downstream systems
• Compliance exposure: Regulatory frameworks require log integrity; undetected tampering can trigger audit failures

Federal Impact

CISA issued Binding Operational Directive 26-04 on June 12, 2026. This directive replaces BOD 22-01 and requires FCEB agencies to prioritize patching based on each vulnerability’s exploitation risk. Therefore, agencies must patch CVE-2026-20253 by Sunday, June 21, 2026.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Upgrade immediately. Patch Splunk Enterprise to versions 10.4.0, 10.2.4, or 10.0.7 or higher.
2. Apply workaround if patching is delayed. Disable the PostgreSQL sidecar service by adding [postgres] disabled = true to $SPLUNK_HOME/etc/system/local/server.conf and restarting Splunk. Note: This breaks Edge Processor, OpAmp, and SPL2 pipelines.
3. Restrict network access. Ensure Splunk management and sidecar ports are not exposed to the public internet.
4. Audit file integrity. Check for unexpected file changes or new files in Splunk directories.
5. Monitor for exploitation indicators. Review access logs for unauthenticated requests to PostgreSQL sidecar endpoints.

Long-Term Security Measures

Organizations should also review their Splunk deployment architecture. Consequently, placing Splunk instances behind VPNs or bastion hosts reduces exposure. Furthermore, enabling endpoint detection and response tools on Splunk servers can catch post-exploitation activity.

Bottom line: With a CVSS 9.8 score, active exploitation, and a federal patch deadline of Sunday, CVE-2026-20253 demands immediate attention. Upgrade Splunk Enterprise today, or disable the PostgreSQL sidecar if your environment allows it.

Incident Summary

CVE ID / Incident:	CVE-2026-20253
Affected Systems:	Splunk Enterprise 10.2.0–10.2.3 and 10.0.0–10.0.6
Disclosure Date:	June 10, 2026
CISA KEV Addition:	June 18, 2026
Federal Patch Deadline:	June 21, 2026 (Sunday)
Patch Status:	Patches available in Splunk Enterprise 10.4.0, 10.2.4, and 10.0.7
CVSS Score:	9.8 Critical

References

1. Splunk, “SVD-2026-0603: Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise,” June 10, 2026 (updated June 18, 2026), https://advisory.splunk.com/advisories/SVD-2026-0603, accessed June 19, 2026.
2. CISA, “CISA Adds One Known Exploited Vulnerability to Catalog,” June 18, 2026, https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-adds-one-known-exploited-vulnerability-catalog, accessed June 19, 2026.
3. WatchTowr Labs, “Why Use App-Level Auth When Every Database Has Auth: Splunk Enterprise CVE-2026-20253 Pre-Auth RCE,” June 12, 2026, https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/, accessed June 19, 2026.
4. CISA, “Known Exploited Vulnerabilities Catalog: CVE-2026-20253,” June 18, 2026, https://www.cisa.gov/known-exploited-vulnerabilities-catalog, accessed June 19, 2026.
5. Shadowserver Foundation, “Splunk Internet Exposure Statistics,” June 2026, https://dashboard.shadowserver.org/statistics/iot-devices/time-series/, accessed June 19, 2026.