Critical unauthenticated vulnerability in Splunk Enterprise

A critical vulnerability identified as CVE-2026-20253 with a CVSS score of 9.8 affects both Splunk Enterprise and Splunk Cloud Platform. It stems from a PostgreSQL sidecar service endpoint that lacks authentication controls, allowing unauthenticated file operations such as creating or truncating arbitrary files. Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, are affected and should be patched. There was no known exploitation or public proof-of-concept code at the time of the observation.

What this means for your organisation

Splunk is often the system meant to tell you that something has happened. A flaw allowing someone to truncate files without authenticating therefore strikes at your ability to detect and investigate incidents. For organisations with reporting obligations this matters on its own: lose the logs and you lose the basis for telling the regulator what actually happened. The absence of known exploitation today simply means you have time to plan the update properly.

Berigo recommends

• Update Splunk Enterprise to at least 10.2.4 or 10.0.7, and confirm your Splunk Cloud version with the supplier.
• Verify that the Splunk installation is not reachable from the internet, including sidecar services on their own ports.
• Ensure logs are replicated to immutable storage, so deletion in Splunk does not delete the evidence.
• Add loss of the logging platform as its own scenario in your incident response plan.

Source

• advisory.splunk.com
• orca.security