CISA Warns of Splunk Enterprise Critical Function Vulnerability Actively Exploited in Attacks

Discover more Security vulnerability scanner Hacking news updates Website security audit HomeCyber Security News CISA Warns of Splunk Enterprise Critical Function Vulnerability Actively Exploited in Attacks By Abinaya June 19, 2026 CISA has issued a high-priority alert warning organizations about a critical vulnerability in Splunk Enterprise that is actively being exploited in the wild. The flaw, tracked as CVE-2026-20253, has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, signaling immediate risk to enterprise environments. According to CISA, the vulnerability stems from a missing authentication mechanism for a critical function within Splunk Enterprise. Specifically, the issue affects a PostgreSQL sidecar service endpoint, which unauthenticated attackers can abuse. Successful exploitation enables threat actors to create or truncate arbitrary files on affected systems, potentially causing severe operational disruption or further compromise. The flaw is categorized under CWE-306 (Missing Authentication for Critical Function), a class of vulnerabilities that continues to pose significant risks due to inadequate access controls on sensitive operations. Splunk Enterprise Function Vulnerability Exploit In this case, attackers do not require valid credentials to exploit the issue, dramatically increasing its severity and making internet-exposed instances particularly vulnerable. Although no ransomware campaigns have been confirmed, CISA has emphasized that the vulnerability poses a high risk due to its ease of exploitation and potential impact. Attackers could leverage arbitrary file creation or deletion capabilities to manipulate system behavior, disrupt logging mechanisms, or stage additional payloads. CISA added CVE-2026-20253 to its KEV catalog on June 18, 2026, and has mandated remediation under Binding Operational Directive (BOD) 26-04. Federal agencies are required to address the vulnerability by June 21, 2026, highlighting the urgency of the threat. The directive prioritizes rapid patching of actively exploited vulnerabilities that pose a significant risk to federal networks. Security teams are strongly advised to follow Splunk’s vendor-provided mitigation guidance. Organizations should immediately assess whether their Splunk Enterprise deployments are exposed to the internet and apply necessary updates or mitigations. If patches are unavailable or cannot be applied in time, CISA recommends discontinuing use of the affected product until it can be secured. Additionally, CISA has urged stakeholders to follow its Forensics Triage Requirements to detect potential compromise. This includes reviewing logs, monitoring unusual file activity, and identifying unauthorized access attempts to the PostgreSQL service endpoint. An example attack scenario could involve an unauthenticated attacker sending crafted requests to the vulnerable endpoint to overwrite critical configuration or log files. This could turn off security monitoring or enable further lateral movement within the network. Organizations using Splunk Enterprise should treat this vulnerability as a top priority. Immediate action, including patching, exposure assessment, and forensic validation, is essential to prevent exploitation and minimize potential damage. Follow us on Google News, LinkedIn, and X to Get More Instant Updates. Tags cyber security cyber security news Copy URL Linkedin Twitter ReddIt Telegram Abinayahttps://cybersecuritynews.com/ Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space. Trending News SearchJack Campaign Uses 23 Chrome Extensions to Hijack Searches of 758,000 Users Microsoft Teams Introduces Office Attendance Tracking via Wi-Fi Connection Google Sues Chinese Cybercrime Network for Using Gemini AI to Launch Cyberattacks Splunk Enterprise Pre-Auth RCE Chain Exposes Database With Zero Authentication Palo Alto Warns of GlobalProtect VPN Vulnerability Actively Exploited in the Wild Latest News Cyber Security News Hackers Use Weaponized Windows Shortcuts to Spread Crypto Clipper Across USB Drives Cyber Security News AI-Powered Public Surveillance and Biometric Data Collection Expand Government Monitoring Cyber Security Authorities Dismantle SocGholish Malware Network — 106 Servers and 101 Domains Seized Cyber Security News New iPhone BootROM Vulnerability Exposes Apple SoCs to Full Chain-of-Trust Compromise Cyber Security Hackers Breached Klue Integration to Steal Salesforce CRM Data via OAuth Tokens