{"id":"CVE-2026-20253","kind":"vulnerability","aliases":["CVE-2026-20253"],"related":[],"title":"In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create…","description":"Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Splunk Enterprise has a missing authentication flaw in a critical function that lets an unauthenticated user create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-06-18T00:00:00+00:00","products":[{"name":"Splunk Enterprise","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"splunk","fixed":["10.0.7"],"affected":">= 10.0.0, < 10.0.7","ecosystem":"vendor"},{"name":"splunk","fixed":["10.2.4"],"affected":">= 10.2.0, < 10.2.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","self-hosted","splunk-enterprise","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the mitigation or patch from Splunk's vendor advisory for CVE-2026-20253; the sources do not name the fixed version. If no mitigation is available, discontinue use of the affected product per CISA BOD 26-04 guidance.","status":"open","published_at":"2026-06-10T18:16:40+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:51+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:33:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation or patch from Splunk's vendor advisory for CVE-2026-20253; the sources do not name the fixed version. If no mitigation is available, discontinue use of the affected product per CISA BOD 26-04 guidance.","summary":"Splunk Enterprise has a missing authentication flaw in a critical function that lets an unauthenticated user create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["splunk-enterprise","self-hosted"],"confidence":0.7,"analyst_note":"Find the Splunk advisory for CVE-2026-20253 to get affected and fixed versions, the PostgreSQL sidecar endpoint details, and any config-based mitigation; check the CISA KEV entry and BOD 26-04 link.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"high"},"cost_usd":0.000399,"input_tokens":2216,"output_tokens":355,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':117C,143C,174C '-20253':20A,23A '-2026':19A,22A '10':9A '10.0.7':12A '10.2':4A '10.2.4':7A '26':116C,142C,173C 'accord':106C 'action':102C 'activ':67B 'adher':170C 'allow':84C 'appli':103C 'applic':140C 'arbitrari':55B,92C 'asset':164C 'authent':41B,77C 'base':121C 'bod':115C,141C,172C 'cisa':63B,100C,113C,130C 'cloud':146C 'complianc':111C 'contain':74C 'could':16A,83C 'creat':17A,52B,89C 'critic':45B,79C 'cve':18A,21A 'discontinu':149C 'endpoint':62B,99C 'ensur':110C,169C 'enterpris':3A,34B,37B,73C 'enterprise':25A 'evalu':162C 'exploit':28B,68B 'exposur':167C 'file':56B,93C 'flaw':42B 'follow':139C 'forens':132C 'function':46B,80C 'guidanc':128C,144C 'guidelin':176C 'host':31B 'instruct':109C 'internet':166C 'let':48B 'list':64B 'miss':40B,76C 'mitig':104C,155C 'note':127C,138C 'patch':175C 'postgresql':59B,96C 'priorit':118C 'product':153C 'requir':101C,134C 'respons':160C 'risk':123C 'secur':119C 'see':124C,135C 'self':30B 'self-host':29B 'servic':61B,98C,147C 'sidecar':60B,97C 'splunk':2A,24A,26A,27A,33B,36B,72C 'splunk-enterpris':32B 'stakehold':158C 'triag':133C 'truncat':54B,91C 'unauthent':14A,50B,86C 'unavail':157C 'updat':120C 'url':125C,136C 'use':150C 'user':15A,51B,87C 'vendor':35B,108C 'version':5A,10A 'vulner':81C 'wild':71B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-10T18:16:40+00:00","kev":{"dateAdded":"2026-06-18","dueDate":"2026-06-21","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-20253","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20253","severity":null,"published_at":"2026-06-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-20253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20253","severity":null,"published_at":"2026-06-10T18:16:40+00:00","modified_at":"2026-07-23T09:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}