CVE-2026-20253 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-20253CRITICAL

Splunk Splunk Enterprise — Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .9694   99.9   YES

AFFECTED
  Product            Versions  Fixed
  Splunk Enterprise  10.2 –    —

TIMELINE
  Oct 8   Reserved by cisco
  Jun 18  Added to CISA KEV, remediation due 2026-06-21
  Jun 18  Published (CNA: cisco)
  Jun 22  DUE DATE PASSED — CVE-2026-20253 (Splunk Enterprise). CISA remediation deadline was June 21, 2026; still in catalog.
  Jul 23  ENRICHED — CVE-2026-20253 (Splunk Enterprise). Received CVSS 9.8 and CPE data from NVD.
  Jul 23  EXPLOIT PUBLISHED — CVE-2026-20253 (Splunk Enterprise). Public exploit reference added.

CWE-306 · CNA: cisco · CVSS v3.1 · 3 references · NVD status: Analyzed · KEV due June 21, 2026

Description

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.

Lifecycle

Complete event history — 6 events, chronological
Date	Event	Detail
October 8, 2025	Reserved	Reserved by cisco
June 18, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-06-21
June 18, 2026	Published	Published (CNA: cisco)
June 22, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2026-20253 (Splunk Enterprise). CISA remediation deadline was June 21, 2026; still in catalog.
July 23, 2026	ENRICHED	ENRICHED — CVE-2026-20253 (Splunk Enterprise). Received CVSS 9.8 and CPE data from NVD.
July 23, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-20253 (Splunk Enterprise). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Splunk	Splunk Enterprise	—	10.2	—

Weaknesses

CWE-306

References (3)

https://advisory.splunk.com/advisories/SVD-2026-0603 [Mitigation, Vendor Advisory]
https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/ [Exploit, Third Party Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20253 [US Government Resource]

Authoritative record: CVE-2026-20253 at cve.org

Vendors: splunk

Weaknesses: CWE-306

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-20253 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.