CISA Orders Federal Agencies to Patch Actively Exploited Splunk Flaw
Summary
CISA says attackers are exploiting CVE-2026-20253, an unauthenticated Splunk Enterprise flaw, and ordered federal agencies to patch. Splunk recommends upgrading; disabling the PostgreSQL sidecar is a mitigation with stated service impacts.
Key points
- CVE-2026-20253 affects Splunk Enterprise versions 10.2.0–10.2.3 and 10.0.0–10.0.6.
- The unauthenticated PostgreSQL sidecar endpoint can let network-reachable attackers create or truncate arbitrary files.
- Splunk reported limited in-the-wild exploitation; CISA separately confirmed active abuse in attacks.
- WatchTowr published proof-of-concept code and warned the flaw could be abused for remote code execution.
- CISA ordered Federal Civilian Executive Branch agencies to patch by Sunday under Binding Operational Directive 26-04.
- Splunk recommends upgrading to a fixed release; disabling the PostgreSQL sidecar is a mitigation but can break Edge Processor, OpAmp, or SPL2 data pipelines.
- Shadowserver tracks over 1,400 internet-exposed Splunk instances, but the article says how many are vulnerable is unknown.
Article Details
- Vulnerability Types
- Unauthenticated arbitrary file creation and truncation
- Severity
- Critical
- Affected Versions
- Splunk Enterprise 10.2.0 to 10.2.3
- Splunk Enterprise 10.0.0 to 10.0.6
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Disable the PostgreSQL sidecar service; this breaks Edge Processor, OpAmp, or SPL2 data pipelines on affected instances.
CVE
Vendors
Products
PostgreSQLThe flaw allows unauthenticated attackers to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.Splunk EnterpriseCISA has ordered federal agencies to patch a critical Splunk Enterprise flaw, CVE-2026-20253, after confirming it is being actively exploited in attacks.