Splunk Enterprise authentication flaw CVE-2026-20253 exploited; fixes available
Attackers are exploiting CVE-2026-20253 to manipulate files on vulnerable Splunk Enterprise servers without signing in. Businesses and family offices using 10.0 or 10.2 should install 10.0.7 or 10.2.4 or later. Splunk Cloud is unaffected.
If your business or family office uses Splunk Enterprise, ask its IT provider to update affected 10.0 installations to 10.0.7 or later, or 10.2 installations to 10.2.4 or later. Families do not need to update personal phones or browsers for this flaw.
What’s happening
CVE-2026-20253 affects Splunk Enterprise, software organisations use to collect and analyse logs and other IT data. Missing authentication in its PostgreSQL sidecar service lets an attacker who can reach that service create files or empty existing files without signing in. NHS England warns this could potentially lead to remote code execution and full system compromise. Splunk released fixes on 10 June, corrected its initial inclusion of Splunk Cloud on 12 June, and confirmed limited exploitation on 18 June. CISA listed the flaw that day. Both affected release branches have fixes. As at 3 November, Splunk's advisory remains last updated on 18 June; it does not identify victims or say that attacks have ended.
- What
- Flaw
- Affects
- Splunk Enterprise
- Affected
- Splunk Enterprise 10.0.0 to 10.0.6
Splunk Enterprise 10.2.0 to 10.2.3 - Fixed in
- Splunk Enterprise 10.0.7
Splunk Enterprise 10.2.4 - Since
- 10 June 2026
- Closed
- 19 June 2026
Timeline
- Update
NHS England updated its warning to report exploitation and advised organisations to apply Splunk's updates. It warned that the flaw could potentially enable remote code execution and full system compromise.
- CISA added
CISA added CVE-2026-20253 to its Known Exploited Vulnerabilities catalogue, as confirmed by Canada's Cyber Centre.
- Wider attacks
Splunk confirmed that its security team had become aware of limited exploitation during June and urged customers to install a fixed release.
- Vendor revised
Splunk added disabling the PostgreSQL sidecar as a temporary mitigation and clarified that versions 9.4 and earlier are unaffected. The workaround must not be used on instances running Edge Processor, OpAmp or SPL2 data pipelines because it breaks those features.
- Vendor revised
Splunk removed Splunk Cloud Platform from the advisory, explaining that it does not use PostgreSQL sidecars and is unaffected.
- Made publicFixed
Splunk disclosed CVE-2026-20253 and provided fixes in Splunk Enterprise 10.0.7 and 10.2.4. Version 10.4.0 is unaffected.
Sources
- SVD-2026-0603: Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk EnterpriseSplunk · 18 June 2026
- Splunk security advisory (AV26-586) – Update 1Canadian Centre for Cyber Security · 18 June 2026
- CISA: Splunk Enterprise flaw actively exploited, patch by SundayBleepingComputer · 19 June 2026
- Critical Splunk Enterprise vulnerability is now getting exploitedThe Stack · 18 June 2026
- Splunk Releases Security Advisory For Critical Vulnerability in Splunk EnterpriseNHS England · 19 June 2026