Reported by 2 outlets

Timeline

1. original reporting

   Splunk Enterprise CVE-2026-20253 — Unauthenticated RCE (CVSS 9.8)

   picussecurity.com · 120d ago · June 16th, 2026

   Splunk disclosed a critical pre-authentication remote code execution vulnerability (CVE-2026-20253, CVSS 9.8) in Splunk Enterprise on June 10. The flaw allows unauthenticated attackers to achieve RCE on the platform that sits at the heart of many security operations centers. Given Splunk's central role in log ingestion and detection, successful exploitation gives attackers full access to sensitive security telemetry.

   ---

2. update from securityweek.com

   Splunk Enterprise CVE-2026-20253 Exploited in Attacks Days After Disclosure — WatchTowr PoC Published, CISA Adds to KEV

   securityweek.com · 117d ago · June 19th, 2026

   CISA added a critical Splunk Enterprise pre-auth RCE vulnerability (CVE-2026-20253) to its Known Exploited Vulnerabilities catalog on June 18, giving federal agencies three days to patch under BOD 26-04 — the first Splunk CVE ever added to KEV. Splunk PSIRT confirmed "limited exploitation" of the flaw, which allows unauthenticated attackers to create or truncate arbitrary files via a PostgreSQL sidecar service endpoint that lacks authentication controls. Two days after Splunk's June 10 advisory, researchers at WatchTowr demonstrated and published a full RCE exploit chain. The bug affects Splunk Enterprise versions 10.2 before 10.2.4 and 10.0 before 10.0.7. Given Splunk's central position in enterprise SOC operations (log ingestion, detection, alerting), successful exploitation provides attackers full access to security telemetry and lateral movement opportunities. Recommended action: Patch immediately if running affected versions. Prioritize as crown-jewel infrastructure — Splunk is both detection platform and attack target.