Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure

A critical Splunk Enterprise vulnerability is being exploited in attacks only days after its public disclosure, and organizations have been urged to patch it immediately.

The vulnerability is tracked as CVE-2026-20253 and Splunk’s advisory says it can be exploited by an unauthenticated attacker to create or truncate arbitrary files via a PostgreSQL sidecar service endpoint.

“The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials,” Splunk said in its advisory.

The security hole affects Splunk Enterprise versions 10.2 before 10.2.4 and 10.0 before 10.0.7. Cisco-owned Splunk announced the availability of patches on June 10.

Two days after its disclosure, researchers at cybersecurity firm WatchTowr demonstrated how CVE-2026-20253 can be exploited by an unauthenticated attacker for remote code execution, publishing technical details and PoC code.