CVE-2026-20253
Splunk Enterprise Missing Authentication for Critical Function Vulnerability
Description
CVE-2026-20253 is a critical missing-authentication vulnerability in Splunk Enterprise that lets an unauthenticated attacker create or truncate arbitrary files on the host. The flaw exists because a PostgreSQL sidecar service endpoint lacks authentication controls, so any network-reachable user can invoke privileged file operations without credentials. Affected are Splunk Enterprise 10.2 versions below 10.2.4 and 10.0 versions below 10.0.7; versions 9.4 and earlier are not affected. Rated CVSS 9.8 (Critical) and listed in the CISA KEV catalog, CVE-2026-20253 is being exploited in the wild, and public research demonstrates a path from this missing-authentication weakness to pre-authentication remote code execution. Organizations running Splunk Enterprise should treat this vulnerability as an urgent patch priority.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| splunk | splunk | >= 10.0.0, < 10.0.7; >= 10.2.0, < 10.2.4 |
References
- https://advisory.splunk.com/advisories/SVD-2026-0603(Mitigation, Vendor Advisory)
- https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20253(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
CVE-2026-20253 is classified under CWE-306 — Missing Authentication for Critical Function. In Splunk Enterprise the PostgreSQL sidecar service exposes file-operation functionality over the network without performing any authentication, so a critical function that should require a proven identity is reachable by anyone. This is the complete absence of authentication rather than a weak check, which is why an unauthenticated attacker can directly invoke file create and truncate operations against the host.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2026-20253 carries a CVSS 3.1 base score of 9.8 (Critical). Attack Vector (Network): the endpoint is remotely exploitable without physical access. Attack Complexity (Low): exploitation is straightforward with no special conditions. Privileges Required (None) and User Interaction (None): no authentication or victim action is needed. Confidentiality, Integrity and Availability (High): an attacker who can create or truncate arbitrary files can overwrite configuration or binaries, corrupt data, and disrupt the service, and public research shows this can be escalated to remote code execution on the host. With an EPSS score of about 10% (95th percentile) and confirmed active exploitation, the realistic impact is full compromise of the Splunk Enterprise server and the sensitive log data it processes.
Exploit Maturity
CISA has added CVE-2026-20253 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Public exploit code is available — watchTowr Labs published a detailed analysis and proof-of-concept for the pre-authentication RCE chain at watchTowr Labs. The EPSS score of roughly 10% (95th percentile) reflects elevated and rising exploitation likelihood. Given confirmed exploitation, a public PoC, and an unauthenticated network attack surface, CVE-2026-20253 requires immediate action.
Remediation
- Apply the vendor fix: upgrade Splunk Enterprise to 10.2.4 or later (10.2.x) or 10.0.7 or later (10.0.x), following CISA's required action to apply vendor instructions by the KEV due date of 2026-06-21.
- If you cannot upgrade immediately, apply Splunk's documented mitigation and disable the PostgreSQL sidecar service to remove the unauthenticated endpoint.
- Restrict network access to the Splunk management and sidecar ports with firewall rules and network segmentation so the endpoint is not reachable from untrusted networks.
- Review file-system integrity and logs for unexpected file creation or truncation and for indicators of the publicly documented exploitation chain.
- As long-term hardening, require authentication on every internal service endpoint and avoid exposing sidecar or administrative services to the network.
Technical Details
The vulnerability stems from CWE-306 (Missing Authentication for Critical Function): the PostgreSQL sidecar service endpoint bundled with Splunk Enterprise performs file operations but never authenticates the caller. Because the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, an attacker only needs network reachability to the endpoint to send a request that creates or truncates a file with the privileges of the Splunk process. Controlling file paths and contents on the host is sufficient to overwrite security-relevant files, which is the basis for the publicly described escalation from unauthenticated file write to remote code execution.
Frequently Asked Questions
Is CVE-2026-20253 being actively exploited?
Yes. CISA lists CVE-2026-20253 in its Known Exploited Vulnerabilities catalog, and watchTowr Labs has published a proof-of-concept for a pre-authentication RCE chain. The EPSS score of about 10% places it in the 95th percentile for exploitation likelihood.
What products are affected by CVE-2026-20253?
Splunk Enterprise 10.2 versions below 10.2.4 and 10.0 versions below 10.0.7 are affected. Splunk Enterprise 9.4 and earlier are not affected.
How do I fix CVE-2026-20253?
Upgrade to Splunk Enterprise 10.2.4 or 10.0.7 (or later) as documented by Splunk. If you cannot upgrade right away, disable the PostgreSQL sidecar service and restrict network access to the affected endpoints.
How severe is CVE-2026-20253?
It is rated Critical with a CVSS 3.1 base score of 9.8. Because it is unauthenticated, network-reachable, and confirmed as actively exploited (95th EPSS percentile), it is one of the highest-priority vulnerabilities to remediate.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.