InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has asked federal agencies to protect their systems by Sunday from a serious Splunk Enterprise flaw that is being used in attacks.
Tracked as CVE-2026-20253, this security flaw impacts Splunk Enterprise (versions 10.2.0 to 10.2.3 and 10.0.0 to 10.0.6). It lets remote attackers without permissions make or delete any files on weak devices using a PostgreSQL sidecar service endpoint.
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
“The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials,” the Splunk security team said in a security advisory published last week.
On June 12, a few days after Splunk fixed security flaws, WatchTowr shared a technical article, provided proof-of-concept code, and warned that the weakness can be used for remote code execution attacks.
On Wednesday, June 18, Splunk told customers to fix their systems right away because they found proof of attacks happening.
“In June 2026, the Splunk Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability. Splunk strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability,” it said.
Shadowserver, a group that checks Internet security, keeps an eye on more than 1,400 Splunk systems that are open on the Internet. Most of these are in North America (952) and Europe (223). But, we don’t know how many of them can be attacked because of the CVE-2026-20253 flaw.
On Thursday, CISA said that hackers are now using the CVE-2026-20253 weakness in their attacks. They told Federal Civilian Executive Branch (FCEB) agencies to fix their Splunk systems by Sunday, as required by Binding Operational Directive (BOD) 26-04.
Issued last week, CISA’s BOD 26-04 requires U.S. government agencies to prioritize patching based on each vulnerability’s risk of exploitation.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the cybersecurity agency said yesterday. “Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.”
Splunk also gave tips for admins who can’t patch vulnerable systems right away, suggesting they turn off the PostgreSQL sidecar service to lower the risk.
