{"id":"splunk-enterprise-authentication-flaw-jun-2026","category":"patch","status":"closed","title":"Splunk Enterprise authentication flaw CVE-2026-20253 exploited; fixes available","tldr":"Attackers are exploiting CVE-2026-20253 to manipulate files on vulnerable Splunk Enterprise servers without signing in. Businesses and family offices using 10.0 or 10.2 should install 10.0.7 or 10.2.4 or later. Splunk Cloud is unaffected.","summary":"CVE-2026-20253 affects Splunk Enterprise, software organisations use to collect and analyse logs and other IT data. Missing authentication in its PostgreSQL sidecar service lets an attacker who can reach that service create files or empty existing files without signing in. NHS England warns this could potentially lead to remote code execution and full system compromise. Splunk released fixes on 10 June, corrected its initial inclusion of Splunk Cloud on 12 June, and confirmed limited exploitation on 18 June. CISA listed the flaw that day. Both affected release branches have fixes. As at 3 November, Splunk's advisory remains last updated on 18 June; it does not identify victims or say that attacks have ended.","action":"If your business or family office uses Splunk Enterprise, ask its IT provider to update affected 10.0 installations to 10.0.7 or later, or 10.2 installations to 10.2.4 or later. Families do not need to update personal phones or browsers for this flaw.","product":"Splunk Enterprise","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-20253"],"tags":["splunk","splunk-enterprise","authentication-bypass","actively-exploited","server"],"affected":["Splunk Enterprise 10.0.0 to 10.0.6","Splunk Enterprise 10.2.0 to 10.2.3"],"fixed":["Splunk Enterprise 10.0.7","Splunk Enterprise 10.2.4"],"matches":[],"sources":[{"kind":"advisory","title":"SVD-2026-0603: Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise","url":"https://advisory.splunk.com/advisories/SVD-2026-0603","by":"Splunk","date":"2026-06-18"},{"kind":"advisory","title":"Splunk security advisory (AV26-586) – Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/splunk-security-advisory-av26-586","by":"Canadian Centre for Cyber Security","date":"2026-06-18"},{"kind":"news","title":"CISA: Splunk Enterprise flaw actively exploited, patch by Sunday","url":"https://www.bleepingcomputer.com/news/security/cisa-splunk-enterprise-flaw-actively-exploited-patch-by-sunday/","by":"BleepingComputer","date":"2026-06-19"},{"kind":"news","title":"Critical Splunk Enterprise vulnerability is now getting exploited","url":"https://www.thestack.technology/critical-splunk-enterprise-vulnerability-is-now-getting-exploited/","by":"The Stack","date":"2026-06-18"},{"kind":"advisory","title":"Splunk Releases Security Advisory For Critical Vulnerability in Splunk Enterprise","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4798","by":"NHS England","date":"2026-06-19"}],"started":"2026-06-10","closed":"2026-06-19","created":"2026-11-03T22:16:41.496Z","updated":"2026-11-03T22:16:41.496Z","cve_notes":[{"cve":"CVE-2026-20253","name":"Missing authentication in Splunk PostgreSQL sidecar","what":"Missing authentication in Splunk Enterprise's PostgreSQL sidecar service lets an attacker who can reach it create arbitrary files or empty existing files without credentials.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-06-19","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"NHS England updated its warning to report exploitation and advised organisations to apply Splunk's updates. It warned that the flaw could potentially enable remote code execution and full system compromise.","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4798","by":"NHS England","patch":null},{"at":"2026-06-18","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-20253 to its Known Exploited Vulnerabilities catalogue, as confirmed by Canada's Cyber Centre.","url":"https://www.cyber.gc.ca/en/alerts-advisories/splunk-security-advisory-av26-586","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-06-18","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Splunk confirmed that its security team had become aware of limited exploitation during June and urged customers to install a fixed release.","url":"https://advisory.splunk.com/advisories/SVD-2026-0603","by":"Splunk","patch":null},{"at":"2026-06-15","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Splunk added disabling the PostgreSQL sidecar as a temporary mitigation and clarified that versions 9.4 and earlier are unaffected. The workaround must not be used on instances running Edge Processor, OpAmp or SPL2 data pipelines because it breaks those features.","url":"https://advisory.splunk.com/advisories/SVD-2026-0603","by":"Splunk","patch":null},{"at":"2026-06-12","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Splunk removed Splunk Cloud Platform from the advisory, explaining that it does not use PostgreSQL sidecars and is unaffected.","url":"https://advisory.splunk.com/advisories/SVD-2026-0603","by":"Splunk","patch":null},{"at":"2026-06-10","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Splunk disclosed CVE-2026-20253 and provided fixes in Splunk Enterprise 10.0.7 and 10.2.4. Version 10.4.0 is unaffected.","url":"https://advisory.splunk.com/advisories/SVD-2026-0603","by":"Splunk","patch":"patched"}],"url":"https://hard.fyi/live/splunk-enterprise-authentication-flaw-jun-2026/","json":"https://hard.fyi/api/live?id=splunk-enterprise-authentication-flaw-jun-2026"}