TECHNOLOGY

United States orders urgent patching of Splunk flaw

▪

Read, Watch or Listen

Media Bias Meter

Sources: 2

Center 100%

Sources: 2

Washington, United States – The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to urgently patch a critical Splunk Enterprise vulnerability, tracked as CVE-2026-20253, after confirming that attackers are actively exploiting it in real-world environments. The flaw, which carries a maximum CVSS severity score of 9.8, stems from improper authentication in the PostgreSQL sidecar service endpoint present in Splunk Enterprise versions 10.0.0 through 10.2.3. Because the endpoint lacks effective authentication controls, unauthenticated remote attackers can create or truncate arbitrary files on the host system, providing a direct path to remote code execution and full system takeover on affected servers. Washington, United States – CISA has added the bug to its Known Exploited Vulnerabilities catalog and shifted from a routine advisory to an emergency hardening order, citing a surge in exploitation attempts following last week’s public disclosure. Researchers at WatchTowr released a technical proof-of-concept exploit soon after the vulnerability became public, and security teams have since observed an immediate increase in attempts to abuse the exposed sidecar service. Under CISA’s directive, organizations must apply the vendor’s patches, review logs for unauthorized file manipulation or suspicious interaction with the PostgreSQL sidecar service, and secure their environments by Sunday or risk mandatory disconnection from federal and critical infrastructure network segments.

Prepared by Jonathan Pierce and reviewed by editorial team.

Timeline of Events

Last week Vulnerability publicly disclosed by researchers
Last week WatchTowr publishes technical exploit details
Last week Proof-of-concept exploit code released
Soon after Surge in active exploitation attempts observed
This week CISA adds CVE to KEV catalog
This week CISA issues emergency hardening directive
By Sunday Agencies must apply Splunk patches
After deadline Noncompliant systems face network disconnection

Why This Matters to You

This Splunk flaw affects your safety. It's being exploited by attackers to gain full control of systems. If you use Splunk Enterprise, you're at risk. Check if your version is between 10.0.0 and 10.2.3. If so, apply the patch immediately.

The Bottom Line

This is a serious vulnerability with a high severity score. It's being actively exploited, and the government is taking urgent action. Worth forwarding if you know someone who uses Splunk Enterprise. They need to patch up by Sunday.