What is the CVSS score of CVE-2026-20253?

CVE-2026-20253 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Splunk Enterprise are affected by CVE-2026-20253?

Splunk Enterprise and Cloud Platform contain a critical unauthenticated file write vulnerability (CVSS 9.8) affecting versions below 10.2.4 / 10.0.7 (Enterprise) and 10.4.2604.3 / 10.2.2510.14…. A patch is available.

Is there a public PoC exploit available for CVE-2026-20253?

Yes, a public proof-of-concept exploit is available for CVE-2026-20253. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-20253?

Within 24 hours: Inventory all Splunk Enterprise and Cloud Platform deployments and verify current versions against affected ranges (10.2.4 / 10.0.7 for Enterprise; 10.4.2604.3 / 10.2.2510.14 for Cloud). Within 7 days: Isolate PostgreSQL sidecar service endpoints from untrusted networks using network segmentation; implement strict ingress controls to restrict access by IP/ASN; enable logging on sidecar endpoints. Within 30 days: Apply vendor patches immediately upon release; prioritize patching of production SOC/security infrastructure instances as critical.

Splunk Enterprise CVE-2026-20253

EUVD-2026-36088 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-10 cisco

GHSA-xgm5-jh99-wc4v

Authentication Bypass PostgreSQL Splunk Splunk Cloud Platform Splunk Enterprise

9.8

CVSS 3.1 · Vendor: cisco

Severity by source

Vendor (cisco) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

Primary rating from Vendor (cisco).

CVSS VectorVendor: cisco

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jun 18, 2026 - 17:02 CISA

Patch available

Jun 10, 2026 - 20:01 EUVD

Analysis Generated

Jun 10, 2026 - 18:35 vuln.today

CVE Published

Jun 10, 2026 - 17:16 nvd

CRITICAL 9.8

DescriptionCVE.org

In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.

Articles & Coverage 4

labs.watchtowr.com Splunk Enterprise CVE-2026-20253: Pre-Authentication RCE via Database Auth Bypass (CVSS 9.8) Jun 12, 2026 POC CVE-2026-20253: Splunk Enterprise Pre-Auth RCE via Unauthenticated PostgreSQL Sidecar Service Endpoint Jun 12, 2026 News 4 New PostgreSQL Vulnerabilities - 2 Critical, 2 High Severity Jun 11, 2026 News Critical Unauthenticated File Write in PostgreSQL Sidecar (Splunk) - CVE-2026-20253 Jun 10, 2026

AnalysisAI

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.4.2604.3 and 10.2.2510.14) allows remote attackers to create or truncate files on the host via an unauthenticated PostgreSQL sidecar service endpoint. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) reflects trivial network exploitation, and no public exploit identified at time of analysis, though the missing-auth root cause and Splunk's high-value position in enterprise SOCs makes prompt patching warranted.

Technical ContextAI

The flaw lives in a PostgreSQL sidecar service shipped with modern Splunk deployments - a co-located helper process that fronts the embedded PostgreSQL instance Splunk uses for parts of its platform state. The CWE-306 (Missing Authentication for Critical Function) classification confirms the root cause: the sidecar exposes a network endpoint that performs privileged file operations (create / truncate) but performs no credential check on the caller. The affected CPEs cover both the on-premises Splunk Enterprise product (cpe:2.3:a:splunk:splunk_enterprise) and the managed Splunk Cloud Platform (cpe:2.3:a:splunk:splunk_cloud_platform), indicating the vulnerable sidecar is part of the shared core platform rather than a deployment-specific add-on.

RemediationAI

Vendor-released patch: upgrade Splunk Enterprise to 10.2.4 or 10.0.7 (or later) on the appropriate maintenance branch, and confirm Splunk Cloud Platform tenants are on 10.4.2604.3 or 10.2.2510.14 (or later) - refer to https://advisory.splunk.com/advisories/SVD-2026-0603 for the official fixed-version matrix and any branch-specific guidance. Where immediate patching is not possible, restrict network reachability to the PostgreSQL sidecar service by binding it to loopback or the internal cluster interface only and adding host-firewall rules that deny inbound connections to the sidecar port from anything other than colocated Splunk components - the trade-off is that any monitoring, backup, or clustering tooling that legitimately reaches the sidecar across hosts will need its source IPs explicitly allowlisted. Verify post-upgrade that the sidecar endpoint now rejects unauthenticated requests before removing compensating network restrictions.