CISA: Patch Splunk Enterprise by Sunday or face RCE attacks

Key Takeaways

• CISA ordered federal agencies to patch CVE-2026-20253 by Sunday, June 22, after confirming active exploitation in the wild
• The flaw allows unauthenticated attackers to create or truncate files via Splunk's PostgreSQL sidecar service, enabling remote code execution
• Over 1,400 Splunk instances are currently exposed to the internet, with 952 in North America alone

CISA added a critical Splunk Enterprise vulnerability to its Known Exploited Vulnerabilities catalog on Thursday, giving federal agencies until Sunday to patch. The flaw, CVE-2026-20253, lets unauthenticated attackers execute arbitrary file operations through an exposed PostgreSQL service, and proof-of-concept exploit code has been public for over a week.

The timing is brutal. Splunk released patches on June 12. WatchTowr published working exploit code the same week. Six days later, Splunk confirmed limited exploitation in the wild. Now federal civilian agencies face a 72-hour remediation window under Binding Operational Directive 26-04.

What makes CVE-2026-20253 dangerous?

The vulnerability sits in Splunk Enterprise's PostgreSQL sidecar service endpoint. According to Splunk's security advisory, the endpoint lacks authentication controls entirely. Any network-reachable user can invoke file operations without credentials.

That sounds abstract until you see the attack chain. An attacker can create or truncate arbitrary files on the target system. Combined with Splunk's execution environment, this opens a path to remote code execution. WatchTowr's proof-of-concept demonstrated exactly this scenario.

Affected versions include Splunk Enterprise 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6. If you're running anything in those ranges and the PostgreSQL sidecar is active, you're exposed.

How many Splunk instances are at risk?

Shadowserver, the internet security watchdog, tracks over 1,400 Splunk instances exposed to the public internet. North America accounts for 952 of those. Europe has another 223.

The catch: Shadowserver's data shows exposure, not vulnerability. Not every internet-facing Splunk instance runs an affected version or has the PostgreSQL sidecar enabled. But given the severity and the active exploitation, the overlap is concerning enough that CISA invoked its emergency patching directive.

What if you can't patch by Sunday?

Splunk offered a workaround: disable the PostgreSQL sidecar service to remove the attack surface entirely. But there's a cost. Disabling PostgreSQL breaks Edge Processor, OpAmp, and SPL2 data pipelines on affected instances.

For organizations relying on those features, that's not a mitigation. It's a choice between a security hole and a broken SIEM. Most security teams will choose the temporary outage. The alternative is leaving a proven RCE vector open while attackers actively probe for targets.

The irony of attacking a security platform

Splunk sits at the heart of security operations for thousands of enterprises and government agencies. It ingests logs, correlates events, and alerts on threats. When attackers compromise Splunk itself, they don't just gain access to one system. They gain visibility into what the defenders can see.

A compromised Splunk instance could let attackers monitor detection rules, understand what triggers alerts, and adjust their tactics to stay invisible. It's the security equivalent of hacking the watchtower.

This makes CVE-2026-20253 particularly attractive to sophisticated actors. The vulnerability offers both access and intelligence, which explains why exploitation appeared so quickly after the PoC dropped.

CISA's new patching framework tightens the timeline

BOD 26-04, issued last week, represents CISA's latest effort to force faster remediation. The directive requires agencies to prioritize patching based on exploitation risk, with actively-exploited vulnerabilities getting the shortest deadlines.

A Sunday deadline for a Thursday announcement means three days, including a weekend. CISA's statement made the reasoning clear: "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise."

Private sector organizations aren't bound by the directive, but they should be watching. If attackers are hitting federal targets, they're hitting commercial ones too. The exploit is public. The clock started when WatchTowr hit publish.

Frequently Asked Questions

What is CVE-2026-20253?

A critical vulnerability in Splunk Enterprise that allows unauthenticated attackers to create or truncate arbitrary files through the PostgreSQL sidecar service endpoint, potentially leading to remote code execution.

Which Splunk Enterprise versions are affected?

Versions 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6 are vulnerable. Splunk has released patches for all affected versions.

What is the CISA KEV catalog?

The Known Exploited Vulnerabilities catalog is CISA's authoritative list of security flaws with confirmed active exploitation. Federal agencies must patch KEV entries within mandated deadlines.

Can I mitigate CVE-2026-20253 without patching?

Yes, by disabling the PostgreSQL sidecar service. However, this breaks Edge Processor, OpAmp, and SPL2 data pipelines, so it's a temporary workaround, not a permanent fix.

Are private companies required to follow CISA's deadline?

No. Binding Operational Directive 26-04 applies only to Federal Civilian Executive Branch agencies. Private organizations should treat the deadline as a strong recommendation given active exploitation.

Source: BleepingComputer