Splunk Enterprise CVE-2026-20253: Patch Critical Sidecar RCE Flaw

Splunk Enterprise administrators should treat CVE-2026-20253 as an urgent patch item: Splunk rates the flaw Critical with a CVSS 9.8 score, and the vendor says an unauthenticated, network-reachable user can create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.^[1] The fixed releases are Splunk Enterprise 10.4.0, 10.2.4, and 10.0.7; Splunk also says its Cloud Platform is not affected because PostgreSQL sidecars are not used there.^[1]

The vulnerability is especially uncomfortable because Splunk often sits close to security telemetry, investigation workflows, and alerting pipelines. A file-write primitive in that environment is not just a server bug; it can become a way to alter local state, damage evidence, or move toward code execution if a deployment exposes the vulnerable path. The CVE record describes the same missing-authentication issue in Splunk Enterprise below 10.2.4 and 10.0.7, while Splunk’s June 12 advisory update narrows the Cloud statement and should be treated as the authoritative scope note for Cloud customers.^[2]

Splunk lists no mitigations, no workarounds, and no detections in the advisory.^[1] That makes version inventory the first useful step: find Splunk Enterprise 10.0.0 through 10.0.6 and 10.2.0 through 10.2.3, then update to 10.0.7 or 10.2.4. Splunk Enterprise 10.4 is listed as not affected with 10.4.0 as the fixed baseline.^[1]

The practical risk rose after watchTowr Labs published technical analysis on June 12. The researchers said the issue could be driven from a pre-authentication position toward remote code execution on susceptible systems, and they highlighted deployment nuance: manually installed Windows instances may not expose the sidecar in the same way, while Splunk Enterprise on AWS was described as vulnerable out of the box in their testing.^[3] The Hacker News summarized the same update on June 13 and noted that public exploit detail can quickly turn a patch advisory into opportunistic scanning pressure.^[4]

What Splunk administrators should check now

First, separate Splunk Enterprise from Splunk Cloud Platform in the asset list. Cloud customers should still track vendor communications, but the immediate self-managed patch work belongs to Enterprise 10.0 and 10.2 deployments below the fixed releases. For self-managed systems, confirm whether the instance is internet-facing, reachable from broad internal networks, or deployed in a cloud environment where management paths are exposed more widely than intended.

Second, do not wait for a KEV listing before acting. CISA’s KEV catalog had not added CVE-2026-20253 during this run, but the combination of unauthenticated access, CVSS 9.8, no workaround, and public RCE-oriented analysis is enough to justify accelerated maintenance. The same operational pattern has recently mattered for other enterprise-facing bugs, including Ivanti Sentry root RCE, Langflow AI workflow server exposure, and Cisco SD-WAN authentication bypass.

Finally, preserve logs before making disruptive changes, then review recent Splunk web and management access for unusual unauthenticated requests, sidecar recovery activity, unexpected file creation or truncation under Splunk paths, and modified local scripts. Those checks cannot replace the upgrade, but they can help teams decide whether this was only an exposure window or a possible incident.

References

1. Splunk Advisory SVD-2026-0603, “Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise,” published June 10, updated June 12, 2026.
2. CVE Program record for CVE-2026-20253, published June 10, 2026.
3. watchTowr Labs, “Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE),” June 12, 2026.
4. The Hacker News, “Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication,” June 13, 2026.