Actively Exploited Splunk Enterprise RCE Drives Urgent Patching

Splunk released fixes for multiple product vulnerabilities, led by CVE-2026-20253, a critical unauthenticated remote code execution flaw in the PostgreSQL sidecar service used by Splunk Enterprise. The bug stems from missing authentication on the sidecar endpoint and can be abused for arbitrary file creation or truncation, enabling full compromise of the Splunk application environment. Affected Splunk Enterprise versions include releases earlier than 10.4.0, 10.2.4, and 10.0.7, while Splunk Cloud Platform fixes include 10.4.2604.3 for the related exposure.

Security sources reported that CVE-2026-20253 is being actively exploited in limited, targeted attacks, prompting CISA to add it to the Known Exploited Vulnerabilities catalog and require rapid federal remediation. Splunk’s broader June security updates also addressed CVE-2026-20251, a remote code execution issue tied to unsafe jsonpickle deserialization in KV Store data, along with additional SSRF, XSS, CSS injection, access-control bypass, and data-exposure flaws across Splunk Enterprise, Splunk Cloud Platform, Splunk Secure Gateway, and Splunk SOAR. Organizations unable to patch immediately were advised to disable the PostgreSQL sidecar service and hunt for signs of exploitation such as path traversal requests, unexpected pg_dump or pg_restore execution, suspicious dump files, and outbound connections to unknown PostgreSQL servers.