Critical Splunk File-Operation Flaw Exposes Enterprise and Cloud Deployments

Splunk disclosed CVE-2026-20253, a critical unauthenticated vulnerability in the PostgreSQL sidecar component of Splunk Enterprise and Splunk Cloud Platform that lets a network-reachable attacker create or truncate arbitrary files on the host. The flaw, tracked as VULN-67169 and SVD-2026-0603, is rated CVSS 9.8 and affects Splunk Enterprise 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, as well as Splunk Cloud Platform versions below 10.4.2604.3 and below 10.2.2510.14. Splunk said fixed versions are available, cloud instances are being actively patched, and no workaround exists other than upgrading.

Splunk also published security content tied to SVD-2026-0603 to help defenders simulate and validate detection of the exposed sidecar behavior, including replayable attack data mapped to MITRE ATT&CK T1210. Separately, the company disclosed CVE-2026-20140, a Windows-only local privilege-escalation flaw in Splunk Enterprise caused by DLL search-order hijacking during service startup; that issue can allow a low-privileged local user to gain NT AUTHORITY\SYSTEM privileges and has been fixed in supported branches, with Splunk advising upgrades, tighter write permissions, and monitoring for suspicious DLL drops and service restarts.