CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Splunk Enterprise pre-auth RCE via unauthenticated PostgreSQL sidecar REST API proxied by web tier, CVSS 9.8

cve · CVE-2026-20253

Coverage
1
first 2026-06-14 → last 2026-10-11
Latest activity
2026-06-20
An unauthenticated Splunk Enterprise flaw lets attackers write files through the database sidecar, enabled by…
Peak priority
high
1 high
Targets
·
regions: europe
Sources cited
4
4 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-20253, newest first. Check the date before acting on an older one.

  • Upgrade Splunk Enterprise 10.0.x and 10.2.x to 10.0.7, 10.2.4 or 10.4.0; where an immediate upgrade is impossible and Edge Processor, OpAmp and SPL2 pipelines are unused, set disabled = true under [postgres] in server.conf and restart.
    2026-06-14CVE-2026-20253

Defender insights

What each entry about CVE-2026-20253 tells a defender to do, newest first.

2026-06-14HIGHexploitedAn unauthenticated Splunk Enterprise flaw lets attackers write files through the database sidecar, enabled by default on AWS

Exposure · detection

Story timeline

  1. 2026-06-14CVE-2026-20253: Splunk Enterprise unauthenticated file write through the PostgreSQL sidecar chains to RCE, exploited and KEV-listed
    trending-vulnerabilitiesAn unauthenticated Splunk Enterprise flaw lets attackers write files through the database sidecar, enabled by default on AWS

Hunting pivots

Affected products
Splunk Enterprise
Tags
actively-exploitedcisa-kevdefault-configpatch-availablepre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Command and ControlIngress Tool Transfer

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-06-14/cve-2026-20253-splunk-enterprise-unauthenticated-pre-auth-rc · ATT&CK page ↗

Command and Control TA0011

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-06-14/cve-2026-20253-splunk-enterprise-unauthenticated-pre-auth-rc · ATT&CK page ↗

Entries about Splunk Enterprise pre-auth RCE via unauthenticated PostgreSQL sidecar REST API proxied by web tier, CVSS 9.8 (1)

2026-06-14 · view entry permalink →

HIGHCVE-2026-20253exploitedupdatedNATOA1

CVE-2026-20253: Splunk Enterprise unauthenticated file write through the PostgreSQL sidecar chains to RCE, exploited and KEV-listed

CVE-2026-20253 (CVSS 9.8, CWE-306) lets an unauthenticated user create or truncate arbitrary files through a PostgreSQL sidecar service endpoint in Splunk Enterprise 10.0.0 to 10.0.6 and 10.2.0 to 10.2.3; Splunk fixed it in 10.0.7, 10.2.4 and 10.4.0, and 9.4 and earlier are not affected (Splunk SVD-2026-0603). watchTowr showed how the web tier proxies requests to the sidecar's backup and restore API, listening on 127.0.0.1:5435, and chained the file write into code execution (watchTowr Labs, 2026-06-12). The sidecar is installed and enabled by default on Splunk Enterprise on AWS, and not by default on manually installed Windows systems (watchTowr Labs, 2026-06-12). Splunk's workaround is setting disabled = true in the [postgres] stanza of server.conf and restarting, except on instances using Edge Processor, OpAmp or SPL2 data pipelines, which it would break (Splunk SVD-2026-0603).

In June 2026, the Splunk Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability.

Splunk 2026-06-10
Updaterun 2026-06-20-4cfd00efactionscvesevidenceregionssectorssourcestagsbody

Splunk updated its advisory to say its PSIRT became aware of limited exploitation in June 2026 (Splunk SVD-2026-0603), and CISA added CVE-2026-20253 to its Known Exploited Vulnerabilities catalog on 2026-06-18 (CISA KEV catalog, 2026-06-18). SecurityWeek reported the exploitation days after disclosure (SecurityWeek, 2026-06-19). The fixes have been available since the advisory of 2026-06-10 (Splunk SVD-2026-0603).

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummarysectorstechniquesaffected_productscvessourcesevidenceclassificationactionsbody

Splunk's advisory confirms limited exploitation and CISA's KEV catalog lists the flaw since 2026-06-18 (Splunk SVD-2026-0603) (CISA KEV catalog, 2026-06-18); the table that showed it as unexploited is removed. The fixes date from 2026-06-10, and Splunk's interim measure is disabling the PostgreSQL sidecar in server.conf, not restricting search-job submission (Splunk SVD-2026-0603). No cited source mentions NCSC-NL.

vulnerability14 Jun 05:00Zmulti-sourceOpen finding →
Sources: Splunk · watchTowr Labs · SecurityWeek · CISA KEV catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • advisory.splunk.com1 (25%)
  • cisa.gov1 (25%)
  • labs.watchtowr.com1 (25%)
  • securityweek.com1 (25%)

External references

NVD · cve.org · CISA KEV

All cited sources (4)