CVE-2026-20253 is a vulnerability in Splunk Enterprise where the PostgreSQL sidecar service endpoint does not enforce authentication, enabling any network-reachable user to perform file operations such as creating or truncating files without credentials. This can be exploited for unauthenticated remote code execution. The vulnerability affects Splunk Enterprise versions prior to 10.2.4 and 10.0.7. Splunk released patches on June 10, 2026, and exploitation was confirmed by Splunk on June 18, with technical details and proof-of-concept code published by researchers. CISA added this vulnerability to its KEV catalog and required federal agencies to patch by June 21, 2026.

The vulnerability allows unauthenticated remote attackers to execute arbitrary code by manipulating files through an unauthenticated PostgreSQL sidecar service endpoint. This can lead to full compromise of affected Splunk Enterprise deployments. Exploitation has been confirmed in the wild shortly after disclosure, increasing the risk to organizations running vulnerable versions.

Splunk has released official patches that fix this vulnerability in versions 10.2.4 and 10.0.7. Organizations should upgrade to these fixed versions immediately to remediate the issue. CISA has mandated rapid patching for federal agencies. No alternative mitigations or workarounds are indicated in the advisory; applying the official fix is required.