CISA Adds the First-Ever Splunk Flaw to Its KEV Catalog, an Unauthenticated File-Write Bug in a PostgreSQL Sidecar Now Exploited in the Wild

Overview

The U.S. Cybersecurity and Infrastructure Security Agency has added a critical Splunk Enterprise vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, the first time a Splunk flaw has appeared on the list, according to SOCRadar. The bug, tracked as CVE-2026-20253, lets an unauthenticated attacker create or truncate arbitrary files through a PostgreSQL sidecar service endpoint, and Splunk has acknowledged limited exploitation in the wild.

CISA added CVE-2026-20253 to its Known Exploited Vulnerabilities catalog on June 18 and gave federal agencies until June 21 to address it, as SecurityWeek reported.

What We Know

The vulnerability carries a CVSS base score of 9.8 and is classified as CWE-306, “Missing Authentication for Critical Function,” according to the National Vulnerability Database. The NVD entry attaches the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

The root cause, per the NVD record, is that “the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.” In Splunk’s own description, summarized by Help Net Security, “an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.”

Splunk published its advisory, tracked as SVD-2026-0603, and announced the availability of patches on June 10, according to the Splunk advisory and SecurityWeek. The flaw affects Splunk Enterprise versions 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6, and is fixed in versions 10.4.0, 10.2.4, and 10.0.7 or higher, per the Splunk advisory. The NVD notes that Splunk Enterprise versions 9.4 and earlier are not affected.

While the vulnerability itself is an unauthenticated file create-or-truncate primitive, researchers showed it can be escalated. watchTowr Labs published proof-of-concept exploit code on June 12, according to SOCRadar — two days after disclosure, as SecurityWeek notes — demonstrating that the flaw can be exploited by an unauthenticated attacker for remote code execution. Help Net Security reported that the bug can be used by attackers to execute arbitrary code and achieve full control over the Splunk application environment.

Splunk’s Product Security Incident Response Team (PSIRT) became aware of limited exploitation of the vulnerability in June 2026, per the Splunk advisory. CISA’s KEV listing the same week marked the first time a Splunk vulnerability has been added to the catalog, according to both SOCRadar and SecurityWeek.

What We Don’t Know

The public reporting does not identify who is behind the in-the-wild exploitation, how many organizations have been compromised, or what the attackers are doing once they gain access. Splunk’s advisory characterizes the activity only as “limited exploitation” without further detail. The cited sources also do not quantify how many internet-reachable Splunk Enterprise instances run the affected 10.0 and 10.2 release lines.

Analysis

The significance of the listing is partly symbolic and partly operational. Splunk is one of the most widely deployed security-information-and-event-management platforms, and the appearance of a Splunk flaw on the KEV catalog for the first time means defenders’ own monitoring infrastructure has become a target. The compressed timeline is the operational concern: patches landed on June 10, a working proof-of-concept followed within two days, and CISA’s catalog entry came roughly a week later with a same-week federal deadline — a pattern that leaves little room for organizations still running the affected releases to test and deploy fixes before exploitation scales.