Splunk Releases Security Advisory For Critical Vulnerability in Splunk Enterprise

Successful exploitation of CVE-2026-20253 could allow a remote unauthenticated attacker to create arbitrary files, potentially enabling remote code execution and full system compromise

Threat ID:: CC-4798
Threat Severity:: Medium
Published:: 17 June 2026 4:24 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation of CVE-2026-20253 could allow a remote unauthenticated attacker to create arbitrary files, potentially enabling remote code execution and full system compromise

Affected platforms

The following platforms are known to be affected:

Splunk Enterprise

Versions 10.0.x prior to 10.0.7
Versions 10.2.x prior to 10.2.4

Note: Splunk Cloud is not affected by this vulnerability.

Threat details

Exploitation of CVE-2026-20253

Following the release of a proof-of-concept exploit, security researchers are reporting exploitation of vulnerability CVE-2026-20253 in the wild, and the US Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.

The NHS England National CSOC assesses further exploitation as highly likely.

Introduction

Splunk has released a security advisory to address a critical vulnerability in Splunk Enterprise. Successful exploitation could allow an unauthenticated attacker to manipulate files and potentially execute arbitrary code on affected systems.

CVE-2026-20253 – "Missing Authentication for Critical Function" vulnerability – CVSS 3.1 score: 9.8

Threat updates

Date	Update
19 Jun 2026	Exploitation of CVE-2026-20253

Remediation advice

Affected organisations are encouraged to review Splunk's SVD-2026-0603 advisory and apply the relevant updates as soon as possible.

Definitive source of threat updates

https://advisory.splunk.com/advisories/SVD-2026-0603

CVE Vulnerabilities

Status Published

CVE-2026-20253

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.

Last edited: 19 June 2026 11:30 am