InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has asked federal agencies to protect their systems by Sunday from a serious Splunk Enterprise flaw that is being used in attacks.
Tracked as CVE-2026-20253, this security flaw impacts Splunk Enterprise (versions 10.2.0 to 10.2.3 and 10.0.0 to 10.0.6). It lets remote attackers without permissions make or delete any files on weak devices using a PostgreSQL sidecar service endpoint.
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
Critical Cisco ISE Vulnerability Enables Remote Code Execution
F5 Patches NGINX Flaw for Code Execution and DoS Attacks
FortiBleed: 70,000 Fortinet Firewalls Compromised Globally
New Rokarolla Android malware hits 217 banking and crypto apps
Phishing Campaign Exploits Legitimate Microsoft Login Flow
ALERT
Cisco SD-WAN Zero-Day, FortiSandbox and cPanel flaws exploited in attacks
“Panthalassa” builds floating AI data centers powered by ocean waves
Critical Wazuh Vuln Enables Alert Tampering and Evidence Deletion
“The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials,” the Splunk security team said in a security advisory published last week.
On June 12, a few days after Splunk fixed security flaws, WatchTowr shared a technical article, provided proof-of-concept code, and warned that the weakness can be used for remote code execution attacks.
On Wednesday, June 18, Splunk told customers to fix their systems right away because they found proof of attacks happening.
“In June 2026, the Splunk Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability. Splunk strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability,” it said.
Shadowserver, a group that checks Internet security, keeps an eye on more than 1,400 Splunk systems that are open on the Internet. Most of these are in North America (952) and Europe (223). But, we don’t know how many of them can be attacked because of the CVE-2026-20253 flaw.
On Thursday, CISA said that hackers are now using the CVE-2026-20253 weakness in their attacks. They told Federal Civilian Executive Branch (FCEB) agencies to fix their Splunk systems by Sunday, as required by Binding Operational Directive (BOD) 26-04.
Issued last week, CISA’s BOD 26-04 requires U.S. government agencies to prioritize patching based on each vulnerability’s risk of exploitation.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the cybersecurity agency said yesterday. “Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.”
Splunk also gave tips for admins who can’t patch vulnerable systems right away, suggesting they turn off the PostgreSQL sidecar service to lower the risk.
