CVE-2026-20253: Splunk Enterprise — Unauthenticated File Manipulation, RCE, SSRF, XSS (June 2026)

CVE-2026-20253 — Splunk Enterprise

Multiple critical vulnerabilities in Splunk Enterprise, including CVE-2026-20253 (CVSS 9.8) and CVE-2026-20251 (CVSS 8.8), are being actively exploited in the wild. CVE-2026-20253 allows unauthenticated attackers to perform arbitrary file manipulation, while CVE-2026-20251 enables remote code execution via unsafe deserialization. Additional issues (CVE-2026-20258, CVE-2026-20252) permit stored XSS and SSRF. These flaws can result in full system compromise, database disruption, and execution of arbitrary code.

Attack Vector

Attackers exploit exposed Splunk Enterprise instances by sending crafted requests that trigger file operations or unsafe deserialization. No authentication is required for CVE-2026-20253, enabling remote actors to overwrite or read sensitive files. For CVE-2026-20251, attackers leverage serialized payloads to execute code on the host. Exploitation can be automated and does not require insider access. Indicators of compromise include unexpected file changes, suspicious process launches, and anomalous outbound connections.

Who Is at Risk

All organizations running Splunk Enterprise are at risk, regardless of deployment type (on-premises, cloud, hybrid). The vulnerabilities affect all supported versions prior to the latest patched release. Splunk is confirmed as the affected vendor; any enterprise with exposed Splunk Enterprise endpoints should assume exposure until patched.

Patch & Mitigate

• Patch: Upgrade to the latest Splunk Enterprise release immediately. Apply all vendor security updates released in June 2026.
• Workaround: Disable or restrict access to vulnerable Splunk components and interfaces. Remove public exposure of Splunk management ports.
• Detect: Monitor for unauthorized file modifications, unexpected process execution, and anomalous requests to Splunk endpoints. Review logs for exploitation attempts and suspicious serialized objects.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit unauthenticated endpoints to gain entry.
• TA0005 — Defense Evasion: Malicious file operations and code execution evade standard controls.
• TA0009 — Collection: Attackers may access sensitive Splunk data and credentials post-compromise.

Source: https://securityonline.info/splunk-enterprise-vulnerabilities-cvss-9-8/