Critical Splunk Enterprise Flaw Enables Unauthenticated Remote Code Execution

Summary

CVE-2026-20253 is a critical, unauthenticated Splunk Enterprise flaw that can enable remote code execution through its PostgreSQL sidecar recovery endpoint. Splunk reported active exploitation, and CISA added it to the KEV catalog.

Key points

• Splunk disclosed CVE-2026-20253 on June 10, 2026, with a CVSS score of 9.8.
• The flaw affects an unauthenticated PostgreSQL sidecar recovery endpoint reachable through Splunk Web.
• Attackers can create or truncate files and ultimately execute code as the Splunk service account.
• Splunk warned of active exploitation on June 18, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.
• CISA directed federal agencies to remediate the flaw by June 21, 2026.
• Compromise could enable log tampering, access to indexed data, and movement into internal networks.
• Zscaler says it deployed protections through Advanced Threat Protection and Private Access AppProtection.

CVE

Vendors

Products

Tools

Related Articles

• Exposed Server Staged NGINX and Ghost CMS Exploits for Targets in 11 CountriesCVE-2026-20253 · Splunk Enterprise
• Recorded Future Reported 59 High-Impact Vulnerabilities in June, 56 Actively ExploitedCVE-2026-20253 · Splunk Enterprise
• Critical Cisco Firewall Management Center RCE Is Under Active ExploitationZscaler Private Access AppProtection