CVE-2026-20253: Splunk Enterprise — Unauthenticated RCE via PostgreSQL (June 2026)

CVE-2026-20253 — Splunk Enterprise

CVE-2026-20253 is a critical vulnerability in Splunk Enterprise (CVSS 9.8) allowing unauthenticated attackers to execute arbitrary code and perform file operations via the PostgreSQL sidecar service endpoint. No in-the-wild exploitation has been confirmed, but exploit details are public and risk of mass exploitation is high.

Attack Vector

Attackers can target the PostgreSQL sidecar service endpoint exposed by vulnerable Splunk Enterprise deployments. Without authentication, an attacker can write arbitrary files to the system, escalate privileges, and execute malicious code. The attack does not require prior access or credentials. All that is needed is network access to the affected endpoint; no IOCs are currently available, but abnormal file creation or process launches by the Splunk service may indicate compromise.

Who Is at Risk

All organizations running Splunk Enterprise prior to versions 10.0.7 and 10.2.4 are at risk. Both on-premises and cloud-hosted Splunk deployments using the vulnerable PostgreSQL sidecar service are affected. Splunk is the only confirmed impacted vendor at this time.

Patch & Mitigate

• Patch: Immediately upgrade to Splunk Enterprise 10.0.7 or 10.2.4. Delaying patching leaves systems open to full compromise.
• Workaround: If patching is not immediately possible, restrict network access to the PostgreSQL sidecar endpoint and monitor for unauthorized connections.
• Detect: Review logs for unexpected file writes, privilege escalations, or unusual processes spawned by the Splunk service. Monitor for connections to the PostgreSQL sidecar service from untrusted sources.

MITRE ATT&CK

• TA0001 — Initial Access: Exploitation enables attackers to gain initial foothold without authentication.
• TA0005 — Defense Evasion: Attackers can escalate privileges and hide activity by writing arbitrary files and executing code.

Source: https://thehackernews.com/2026/06/critical-splunk-enterprise-flaw-lets.html