Loading story…
Splunk disclosed CVE-2026-20253, a critical unauthenticated vulnerability in the PostgreSQL sidecar component of Splunk Enterprise and Splunk Cloud Platform that lets a network-reachable attacker create or truncate arbitrary files on the host. The flaw, tracked as VULN-67169 and SVD-2026-0603, is rated CVSS 9.8 and affects Splunk Enterprise 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, as well as Splunk Cloud Platform versions below 10.4.2604.3 and below 10.2.2510.14. Splunk said fixed versions are available, cloud instances are being actively patched, and no workaround exists other than upgrading.
Splunk also published security content tied to SVD-2026-0603 to help defenders simulate and validate detection of the exposed sidecar behavior, including replayable attack data mapped to MITRE ATT&CK T1210. Separately, the company disclosed CVE-2026-20140, a Windows-only local privilege-escalation flaw in Splunk Enterprise caused by DLL search-order hijacking during service startup; that issue can allow a low-privileged local user to gain NT AUTHORITY\SYSTEM privileges and has been fixed in supported branches, with Splunk advising upgrades, tighter write permissions, and monitoring for suspicious DLL drops and service restarts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Splunk Research published SVD-2026-0603 as attack simulation material for the unauthenticated arbitrary file creation issue in the PostgreSQL sidecar service. The dataset provides replay and import guidance for testing and is explicitly described as simulation content rather than an incident report.
Splunk disclosed CVE-2026-20253, a critical unauthenticated vulnerability in Splunk Enterprise and Splunk Cloud Platform that allows arbitrary file creation or truncation through an exposed PostgreSQL sidecar endpoint. Splunk released fixed versions for affected Enterprise branches and said it was actively patching affected cloud instances, with no workaround available beyond upgrading.
Splunk disclosed CVE-2026-20140, a high-severity local privilege-escalation vulnerability affecting Splunk Enterprise for Windows. The company assigned advisory SVD-2026-0205 and released fixed versions across supported branches, noting that non-Windows deployments are not impacted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourcezeropath.com
Open sourceop-c.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk issued urgent fixes for **CVE-2026-20253**, a critical `CVSS 9.8` vulnerability in **Splunk Enterprise** that allows unauthenticated arbitrary file creation and truncation through a PostgreSQL sidecar service endpoint missing authentication controls. The flaw affects supported Splunk Enterprise releases prior to **10.4.0**, **10.2.4**, **10.0.7**, **9.4.12**, and **9.3.13** depending on branch, and Splunk said **Splunk Cloud is not affected** because it does not use Postgres sidecars. Splunk and national cyber authorities urged administrators to apply updates immediately, noting that no vendor detections or workarounds were initially available for the core issue. Public technical analysis from watchTowr Labs showed the bug can be reached through Splunk Web on port `8000`, which proxies requests to localhost-only PostgreSQL recovery endpoints, enabling attackers to abuse `/v1/postgres/recovery/backup` and `/restore` for filesystem access. Researchers demonstrated a full pre-auth exploitation chain that used path traversal, PostgreSQL connection-string injection, local `.pgpass` credentials, and PostgreSQL large-object export to gain arbitrary file write as the `splunk` user, then overwrite a Splunk Python script to achieve remote code execution. Splunk also disclosed additional Enterprise flaws including **CVE-2026-20251** (`CVSS 8.8`) in the Splunk Secure Gateway app due to unsafe `jsonpickle` deserialization, plus stored XSS and SSRF issues, prompting guidance to patch quickly, restrict dashboard creation and web exposure, and disable or remove vulnerable components where immediate upgrades are not possible.
Jul 23, 2026
Splunk released fixes for multiple product vulnerabilities, led by **`CVE-2026-20253`**, a critical **unauthenticated remote code execution** flaw in the PostgreSQL sidecar service used by Splunk Enterprise. The bug stems from missing authentication on the sidecar endpoint and can be abused for arbitrary file creation or truncation, enabling full compromise of the Splunk application environment. Affected Splunk Enterprise versions include releases earlier than **10.4.0**, **10.2.4**, and **10.0.7**, while Splunk Cloud Platform fixes include **10.4.2604.3** for the related exposure. Security sources reported that **`CVE-2026-20253`** is being actively exploited in limited, targeted attacks, prompting **CISA** to add it to the **Known Exploited Vulnerabilities** catalog and require rapid federal remediation. Splunk’s broader June security updates also addressed **`CVE-2026-20251`**, a remote code execution issue tied to unsafe `jsonpickle` deserialization in KV Store data, along with additional SSRF, XSS, CSS injection, access-control bypass, and data-exposure flaws across Splunk Enterprise, Splunk Cloud Platform, Splunk Secure Gateway, and Splunk SOAR. Organizations unable to patch immediately were advised to disable the PostgreSQL sidecar service and hunt for signs of exploitation such as path traversal requests, unexpected `pg_dump` or `pg_restore` execution, suspicious dump files, and outbound connections to unknown PostgreSQL servers.
Jul 8, 2026
Splunk released security updates for multiple vulnerabilities in **Splunk Enterprise** and **Splunk Cloud Platform**, led by **`CVE-2026-20296`**, a high-severity flaw in the Deployment Server component of Splunk Web. The bug combines missing CSRF validation on `GET` requests with improper neutralization of user-controlled input, allowing an attacker to trick a user with the `list_deployment_server` capability into triggering arbitrary SPL searches as `splunk-system-user`. Successful exploitation could expose indexed data and stored credentials, with additional integrity and limited availability impact. The update also addresses **`CVE-2026-20297`** in the App Install REST endpoint and **`CVE-2026-20298`** in the `storage/passwords` REST endpoint, which could enable path traversal and disclosure of stored credential hashes. Splunk published patched versions and mitigation guidance for customers, while **Splunk Cloud Platform** instances are being patched and monitored by Splunk. **Splunk Enterprise** administrators were advised to upgrade promptly and apply a configuration change to reduce exposure from the credential-hash disclosure issue.
Jul 17, 2026