Answer in brief
CVE-2026-20253 records a High severity vulnerability in Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise. The current sources mark it as known exploited. The current feed maps Splunk/Splunk Enterprise (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Splunk/Splunk Enterprise (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Splunk/Splunk Enterprisegeneric | >=10.2 <10.2.4 || >=10.0 <10.0.7 | 10.2.4, 10.0.7 |
Published upstream
Jun 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
Added to CISA KEV
Jun 18, 2026
Evidence: source:kev:kev:kev:recordIn Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-20253 records a High severity vulnerability in Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise. The current sources mark it as known exploited. The current feed maps Splunk/Splunk Enterprise (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Splunk/Splunk Enterprise (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Splunk/Splunk Enterprisegeneric | >=10.2 <10.2.4 || >=10.0 <10.0.7 | 10.2.4, 10.0.7 |
Published upstream
Jun 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
Added to CISA KEV
Jun 18, 2026
Evidence: source:kev:kev:kev:recordIn Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials. Splunk Enterprise versions 9.4 and earlier are not affected. If you cannot immediately upgrade to a fixed version, you can mitigate this vulnerability by disabling the PostgreSQL sidecar service.
Quoted source text, attributed separately from HOL analysis.