InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has asked federal agencies to protect their systems by Sunday from a serious Splunk Enterprise flaw that is being used in attacks.
Tracked as CVE-2026-20253, this security flaw impacts Splunk Enterprise (versions 10.2.0 to 10.2.3 and 10.0.0 to 10.0.6). It lets remote attackers without permissions make or delete any files on weak devices using a PostgreSQL sidecar service endpoint.
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
Thousands of MCP Servers Exposed to File Access and Injection Attacks
CERT/CC Alerts to Hidden Admin Backdoor in Tenda Router Firmware
Daily Cyber security update for 6. 07. 2026
“Bad Epoll” 0-Day Vulnerability Allows Root Access on Linux Servers, Android Devices
An AI performed a cyber attack without any human help for the first time
“The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials,” the Splunk security team said in a security advisory published last week.
On June 12, a few days after Splunk fixed security flaws, WatchTowr shared a technical article, provided proof-of-concept code, and warned that the weakness can be used for remote code execution attacks.
On Wednesday, June 18, Splunk told customers to fix their systems right away because they found proof of attacks happening.
“In June 2026, the Splunk Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability. Splunk strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability,” it said.
Shadowserver, a group that checks Internet security, keeps an eye on more than 1,400 Splunk systems that are open on the Internet. Most of these are in North America (952) and Europe (223). But, we don’t know how many of them can be attacked because of the CVE-2026-20253 flaw.
On Thursday, CISA said that hackers are now using the CVE-2026-20253 weakness in their attacks. They told Federal Civilian Executive Branch (FCEB) agencies to fix their Splunk systems by Sunday, as required by Binding Operational Directive (BOD) 26-04.
Issued last week, CISA’s BOD 26-04 requires U.S. government agencies to prioritize patching based on each vulnerability’s risk of exploitation.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the cybersecurity agency said yesterday. “Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.”
Splunk also gave tips for admins who can’t patch vulnerable systems right away, suggesting they turn off the PostgreSQL sidecar service to lower the risk.
