CVE-2026-20253
An unauthenticated attacker can create or delete any file on a Splunk Enterprise system by calling a PostgreSQL sidecar service that lacks authentication. The flaw exists in versions 10.2 and 10 before 10.2.4 and 10.0.7, respectively. Upgrading to a fixed release or disabling the sidecar service stops the attack.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Splunk Enterprise 10.2.x (below 10.2.4) and 10.0.x (below 10.0.7). Versions 9.4 and earlier are not affected.
Real-world impact
An attacker could write or erase files on the host, potentially installing malware, deleting logs, or corrupting data, leading to loss of confidentiality, integrity, and availability.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network with no authentication, and it allows complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade Splunk Enterprise to version 10.2.4 or later, or 10.0.7 or later.
NVD-referenced vendor advisory
Timeline
- Jun 10, 2026 · Jun 10, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jun 18, 2026 · Jun 18, 2026Confirmed exploited (CISA KEV)CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
- Jun 21, 2026 · Jun 21, 2026CISA remediation deadlineFederal agencies are required to remediate by this date.
- Jul 23, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 23, 2026 · 7d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- advisory.splunk.com/advisories/SVD-2026-0603mitigationvendor advisory
- labs.watchtowr.com/why-use-app-level-auth-when…exploitthird party advisory
- cisa.gov/known-exploited-vulnerabili…us government resource