Splunk and Cisco: Critical Splunk Enterprise Vulnerability Enables Unauthenticated Remote Code Execution

Critical Splunk Enterprise Vulnerability (CVE-2026-20253) Exposes Systems to Unauthenticated RCE

Security researchers have disclosed a critical vulnerability in Splunk Enterprise, tracked as CVE-2026-20253, which allows unauthenticated attackers to execute arbitrary code on vulnerable systems. The flaw, rated 9.8 (CVSS), affects Splunk’s widely used SIEM and data analytics platform, posing severe risks to enterprises that rely on it for security monitoring and operational visibility.

Vulnerability Details

The flaw resides in a PostgreSQL sidecar service within Splunk Enterprise, which lacks proper authentication controls. Attackers can exploit this to perform arbitrary file operations, including creating, modifying, or deleting files potentially leading to remote code execution (RCE).

Affected Versions:

• Splunk Enterprise 10.0.0–10.0.6
• Splunk Enterprise 10.2.0–10.2.3

Patched Versions:

• Splunk Enterprise 10.0.7
• Splunk Enterprise 10.2.4
• Splunk Enterprise 10.4 (unaffected)
• Splunk Cloud (unaffected, as it does not use the vulnerable PostgreSQL sidecar)

Exploitation Mechanism

Researchers at watchTowr Labs demonstrated how attackers can chain two vulnerable endpoints /v1/postgres/recovery/backup and /v1/postgres/recovery/restore to achieve RCE without authentication.

1. Backup Exploitation: Attackers connect a vulnerable Splunk instance to a malicious PostgreSQL database, writing a crafted dump to arbitrary filesystem locations.
2. Restore Exploitation: By manipulating the .pgpass file (containing PostgreSQL credentials), attackers execute SQL commands under the postgres_admin account.
3. Arbitrary File Write: Using PostgreSQL’s lo_export function, attackers write malicious files to the system.
4. RCE via Script Overwrite: Attackers replace legitimate Splunk scripts (e.g., Python files in the Splunk Secure Gateway) with malicious payloads, executing code under the service’s privileges.

Impact & Risks

Splunk is a centralized security and operational intelligence platform, aggregating logs from:

• Domain controllers, firewalls, cloud infrastructure, EDR systems, and identity providers
• Critical business applications and network devices

A compromised Splunk instance could allow attackers to:

• Access sensitive operational data (security alerts, authentication logs, network architecture)
• Tamper with or delete logs, hindering incident detection and forensic investigations
• Move laterally within an organization, leveraging Splunk’s privileged access to other systems

Response & Mitigation

Splunk and Cisco have released emergency patches and urge organizations to:

• Upgrade immediately to 10.0.7 or 10.2.4
• Restrict network access to Splunk administrative interfaces
• Monitor for unusual PostgreSQL recovery activity and unauthorized file modifications
• Conduct threat hunting for indicators of compromise

While no active exploitation has been confirmed, the public release of technical details increases the risk of automated scanning and weaponization by threat actors, including ransomware groups and state-sponsored attackers. Enterprises are advised to treat this as a high-priority remediation issue.

Source: https://www.linkedin.com/pulse/critical-splunk-enterprise-vulnerability-enables-t7wye

Splunk cybersecurity rating report: https://www.rankiteo.com/company/splunk

Cisco cybersecurity rating report: https://www.rankiteo.com/company/cisco

"id": "SPLCIS1781519269",
"linkid": "splunk, cisco",
"type": "Vulnerability",
"date": "6/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'Enterprises using Splunk '
                                              'Enterprise versions '
                                              '10.0.0–10.0.6 and 10.2.0–10.2.3',
                        'industry': 'Technology/Enterprise Software',
                        'name': 'Splunk Enterprise',
                        'type': 'Software'}],
 'attack_vector': 'Remote',
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Security alerts, authentication '
                                             'logs, network architecture, '
                                             'operational data'},
 'description': 'Security researchers have disclosed a critical vulnerability '
                'in Splunk Enterprise, tracked as CVE-2026-20253, which allows '
                'unauthenticated attackers to execute arbitrary code on '
                'vulnerable systems. The flaw, rated 9.8 (CVSS), affects '
                'Splunk’s widely used SIEM and data analytics platform, posing '
                'severe risks to enterprises that rely on it for security '
                'monitoring and operational visibility.',
 'impact': {'data_compromised': 'Sensitive operational data (security alerts, '
                                'authentication logs, network architecture)',
            'operational_impact': 'Tampering or deletion of logs, hindering '
                                  'incident detection and forensic '
                                  'investigations; lateral movement within an '
                                  'organization',
            'systems_affected': 'Splunk Enterprise (10.0.0–10.0.6, '
                                '10.2.0–10.2.3)'},
 'post_incident_analysis': {'corrective_actions': 'Patch management, network '
                                                  'access restrictions, '
                                                  'enhanced monitoring',
                            'root_causes': 'Lack of proper authentication '
                                           'controls in PostgreSQL sidecar '
                                           'service within Splunk Enterprise'},
 'recommendations': ['Upgrade immediately to Splunk Enterprise 10.0.7 or '
                     '10.2.4',
                     'Restrict network access to Splunk administrative '
                     'interfaces',
                     'Monitor for unusual PostgreSQL recovery activity and '
                     'unauthorized file modifications',
                     'Conduct threat hunting for indicators of compromise'],
 'references': [{'source': 'watchTowr Labs'}],
 'response': {'containment_measures': 'Restrict network access to Splunk '
                                      'administrative interfaces',
              'enhanced_monitoring': 'Monitor for unusual PostgreSQL recovery '
                                     'activity and unauthorized file '
                                     'modifications',
              'remediation_measures': 'Upgrade to Splunk Enterprise 10.0.7 or '
                                      '10.2.4'},
 'title': 'Critical Splunk Enterprise Vulnerability (CVE-2026-20253) Exposes '
          'Systems to Unauthenticated RCE',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2026-20253'}