Summary
A critical vulnerability in Splunk Enterprise (CVE-2026-20253) with a perfect CVSS score of 9.8 is now being actively exploited in the wild, just days after its disclosure on June 10. The flaw allows unauthenticated attackers to perform arbitrary file operations and achieve remote code execution through an exposed PostgreSQL sidecar service endpoint that lacks authentication controls.
Splunk updated its advisory on June 18 confirming limited exploitation in the wild, and CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a mandatory federal patching deadline of June 21 — giving agencies just three days to remediate. Affected versions include Splunk Enterprise below 10.2.4 and 10.0.7. Splunk Cloud is not impacted.
Researchers have demonstrated that the vulnerability can be chained with PostgreSQL’s lo_export function to write and execute malicious scripts, achieving full pre-authenticated RCE. Organizations unable to immediately upgrade can disable the PostgreSQL sidecar service as a workaround, though this may impact Edge Processor, OpAmp, and SPL2 data pipeline features.
Sources
- SecurityWeek — Splunk Enterprise Vulnerability Exploited in Attacks
- BleepingComputer — CISA: Splunk Enterprise Flaw Actively Exploited
- Splunk Advisory SVD-2026-0603
Commentary
This is a textbook example of why patch cycles matter. A CVSS 9.8 unauthenticated RCE in one of the most widely deployed SIEM platforms is about as bad as it gets for enterprise security teams. The fact that exploitation was confirmed within a week of disclosure — and the fix was already available — means anyone still running vulnerable versions is essentially leaving the front door unlocked.
The three-day CISA deadline is unusually aggressive, which tells you how seriously the government is taking this. If your Splunk deployment is internet-facing or reachable from compromised segments, treat this as a drop-everything priority. The PostgreSQL sidecar workaround buys time but breaks functionality — upgrading is the only real answer here.