CVE-2026-20253

Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

Exploited in the wild. In CISA KEV since 2026‑06‑18. Fixed versions are out.

CVSS 3.19.8Critical EPSS percentile99th97% chance in 30 days CISA KEVListedsince 2026-06-18, due 2026-06-21
No public exploit known Fix2 products2 fixed builds listed below

Check it yourself

Nuclei · 1 templateOpenVAS · 2 checks

e.g. Splunk Enterprise & Cloud Platform - Unrestricted File Upload · OID 1.3.6.1.4.1.25623.1.0.157123

Run the check

Published 2026-06-10Updated 2026-07-23Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Splunk EnterpriseAffected: ≥ 10.2, < 10.2.4Upgrade to: 10.2.4Affected: ≥ 10.0, < 10.0.7Upgrade to: 10.0.7Stated by: CVE record
SplunkAffected: ≥ 10.0.0, < 10.0.7Upgrade to: 10.0.7Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your Splunk Enterprise version and whether the PostgreSQL sidecar service is enabled and reachable from the network.
Confirm the system is exposed to untrusted networks (for example, internet reachability) on the PostgreSQL sidecar endpoint.
Upgrade Splunk Enterprise to 10.2.4 or later if you are on the 10.2.x branch.
Upgrade Splunk Enterprise (or Splunk) to 10.0.7 or later if you are on the 10.0–10.1 branch.
If you cannot upgrade immediately, disable the PostgreSQL sidecar service per Splunk guidance and restrict network access to the endpoint.

Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

5 publishers

CISA warned Splunk Enterprise CVE-2026-20253 is actively exploited, where an unauthenticated PostgreSQL sidecar endpoint can create or truncate arbitrary files on vulnerable systems.
as reported · Jun 19, 2026·BleepingComputer
Added to CISA KEV catalog
Jun 18, 2026·CISA KEV
Splunk released fixes for CVE-2026-20253, where an unauthenticated PostgreSQL sidecar endpoint could enable arbitrary file operations and potential pre-auth RCE.
as reported · Jun 13, 2026·The Hacker News summary
Technical analysis published
as reported · Jun 12, 2026·watchTowr Labs summary

Sourced from public security reporting — each date is when it was published, not when it happened. 5 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.

In plain language

Written by AI from the record

CVE-2026-20253 is a critical Splunk Enterprise bug that lets an internet attacker, without logging in, create or wipe arbitrary files via a PostgreSQL sidecar endpoint—if you run Splunk Enterprise 10.2.x below 10.2.4 or 10.x below 10.0.7 with that sidecar enabled, you should act immediately.

CVE-2026-20253 is an unauthenticated arbitrary file creation and truncation issue in Splunk Enterprise caused by missing authentication controls on a PostgreSQL sidecar service endpoint; affected versions (Splunk Enterprise 10.2.x < 10.2.4 and Splunk Enterprise/ Splunk 10.x < 10.0.7) can be remotely triggered without user interaction when the endpoint is network-reachable.

If you're affected

Full system compromise possible
Service outage via file truncation
Sensitive data exposure risk
Incident response and forensics costs

What is it

This vulnerability lets a remote attacker interact with a built-in “sidecar” PostgreSQL connection used by Splunk and force the server to create or wipe files, without needing any login. Think of it like leaving a door on your building that opens a storage closet—an attacker doesn’t need a key to start moving or destroying items.

Who is affected

This matters if you run Splunk Enterprise and your version is in the affected ranges (Splunk Enterprise 10.2.x below 10.2.4 or Splunk 10.x below 10.0.7 / Splunk Enterprise 10.x below 10.0.7) and the PostgreSQL sidecar service is enabled and reachable over the network. Because the flaw is unauthenticated and needs no user action, it’s especially risky if that endpoint can be reached from untrusted networks (including the internet).

How urgent is it

This is already being exploited in the real world, and CISA has added it to its Known Exploited Vulnerabilities list with a short remediation deadline. With an unauthenticated file create/delete capability, attackers can move quickly to disrupt services and potentially escalate impact, so treat this as an emergency patch.

What to do — in detail

Identify exposure (affected software + endpoint reachability)
- Verify your Splunk Enterprise/Splunk version.
  - Splunk Enterprise is affected if it is 10.2.x below 10.2.4.
  - Splunk Enterprise and Splunk are affected if it is 10.x below 10.0.7.
- Check whether the PostgreSQL sidecar service is enabled.
- Determine whether the PostgreSQL sidecar service endpoint is reachable over the network from untrusted systems (and especially whether it is internet-accessible).
Determine whether you need to act urgently on already-deployed systems
- Since this is listed in CISA KEV and reported exploited in attacks, assume compromise attempts may already be underway on exposed instances.
Apply the correct fix
- Upgrade to the fixed versions:
  - Splunk Enterprise: fixed in 10.2.4 (for the 10.2.x branch).
  - Splunk Enterprise and Splunk: fixed in 10.0.7 (for the 10.0–10.1 branch).
If upgrade cannot be completed immediately (temporary mitigation)
- Disable the PostgreSQL sidecar service (per Splunk’s guidance in the referenced advisory).
- Restrict network access so the endpoint is not reachable from untrusted networks.
Forensics/monitoring after remediation (what to look for)
- Review logs and investigate file changes around the time of exposure attempts.
- Monitor for unusual file creation/deletion activity linked to the PostgreSQL sidecar service endpoint.
- Validate that the sidecar endpoint is no longer reachable when mitigated (and that the service behavior matches post-upgrade expectations).
Follow CISA timing guidance
- CISA KEV remediation due date: 2026-06-21.
- Apply mitigations in accordance with vendor instructions and comply with CISA’s BOD 26-04 prioritization guidance and forensics triage requirements referenced by CISA.

Technical context

Severity: Critical (CVSS 9.8). Weakness: CWE-306 (missing authentication for critical functionality), specifically unauthenticated arbitrary file creation and truncation.

Mechanism: A PostgreSQL sidecar service endpoint in Splunk Enterprise lacks authentication controls, allowing remote callers to invoke file operations without credentials.

Attack vector & prerequisites: Network-reachable endpoint, no user interaction, no authentication required. The known precondition is that Splunk Enterprise is running a vulnerable version and the PostgreSQL sidecar service is enabled and accessible over the network.

Exploitation status: Confirmed exploited in the wild (KEV listed by CISA; added 2026-06-18; CISA remediation due 2026-06-21). No public exploit code is listed on record, but that does not reduce urgency given active exploitation.

EPSS note: Prediction indicates very high likelihood with an upward trend, but KEV/news reporting supersedes predictions for urgency decisions.

What KEV means here: CISA’s Known Exploited Vulnerabilities catalog indicates the vulnerability is being exploited in real environments, making it a prioritized remediation target.

Workaround/mitigation: Disable the PostgreSQL sidecar service and restrict access to the endpoint when upgrading is not immediately possible.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2026-06-18.

US federal agencies must remediate by 2026-06-21.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

97% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

20 events over 56 days, from the signal feeds we watch.

2026-08-05Analysis publishedThe guardian is the gateway: 2026's exploited-bug list is a map of the security products we trusted
2026-07-31Analysis publishedSplunk Enterprise's open sidecar: the unauthenticated 9.8 that turns your SIEM into a foothold (CVE-2026-20253)
2026-07-24EPSS band changehigh → criticalepss band change
2026-07-23Patch availableworkaround available, record updated
2026-06-29EPSS band changemoderate → high
2026-06-28EPSS band changemoderate → high

Affected products

Splunkcommercial · USaka splunk enterprise, splunk cloud platform
- splunkSecurity Products
- Splunk EnterpriseSecurity Products

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-306No name in the record

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Initial AccessT1078Valid Accountshigh confidence T1190Exploit Public-Facing Applicationhigh confidence

Sources

References in the record

Analysis on the cve.tools blog

In the news

All news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Splunk, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account