Splunk CVE-2026-20253: a 72-hour triage and remediation runbook

Summary. CVE-2026-20253 is a critical, unauthenticated remote code execution flaw in Splunk Enterprise with a CVSS v3.1 score of 9.8, disclosed by Splunk as advisory SVD-2026-0603 on 10 June 2026. It is the first Splunk vulnerability ever added to CISA's Known Exploited Vulnerabilities catalog, which happened on 18 June 2026 — the same day Splunk updated the advisory to confirm exploitation in the wild. The window was brutally short: watchTowr Labs published a working proof-of-concept on 12 June, just two days after disclosure, and CISA's Binding Operational Directive 26-04 gave US federal agencies until 21 June to remediate. The affected builds are Splunk Enterprise 10.2.x below 10.2.4 and 10.0.x below 10.0.7. Splunk Cloud Platform and Splunk Enterprise 9.4 and earlier are not affected, because they do not run the vulnerable PostgreSQL sidecar service. The fix is an upgrade to 10.4.0, 10.2.4, 10.0.7, or later; the stopgap is one stanza in server.conf that disables the sidecar. What makes this one dangerous beyond the CVSS number: Splunk is your log tier, so an attacker who lands here can delete the evidence of every other intrusion.

This runbook gives you the version matrix, the exact workaround and its caveats, the indicators to hunt for, and an hour-by-hour plan for the first three days.

What the vulnerability actually is

Splunk Enterprise 10.x ships an internal PostgreSQL sidecar service that listens only on 127.0.0.1:5435. On its own, that would be low-risk. The problem is that Splunk Web, on the default management port TCP 8000, acts as a reverse proxy and forwards requests to the sidecar's recovery endpoints without enforcing authentication. Zscaler's ThreatLabz team, who published a full technical breakdown on 26 June 2026, describe the core failure precisely: the recovery endpoints "accept any Authorization: Basic header value, including empty credentials," so a locally-bound service becomes reachable and abusable from the network.

The chain from there is short:

1. An unauthenticated attacker POSTs to /en-US/splunkd/__raw/v1/postgres/recovery/backup on port 8000 with a blank Basic Og== credential.

1. The backupFile parameter is passed straight to pg_dump with no validation, so path-traversal sequences let the attacker create or truncate files anywhere writable.

1. Connection-string injection (hostaddr=) points Splunk at an attacker-controlled PostgreSQL server, turning empty-file creation into arbitrary-content write.

1. A passfile= injection reuses Splunk's plaintext credentials at /opt/splunk/var/packages/data/postgres/.pgpass to authenticate as postgres_admin.

1. Overwriting a scheduled Python script — Zscaler names ssg_enable_modular_input.py in the Secure Gateway app — gives code execution under the Splunk service account on the next scheduled run.

No credentials are required at any step. That is the whole reason this scores 9.8.

The version matrix, exactly

Get this right first, because everything else depends on it.

Splunk's own recommendation in SVD-2026-0603 is to move to 10.4.0, 10.2.4, or 10.0.7 or higher. If you are on the 10.2 train and cannot jump to 10.4, 10.2.4 is the minimum acceptable landing point; the same logic applies to 10.0.7 on the 10.0 train.

The temporary workaround, and when it will break your platform

If you genuinely cannot patch inside the first day, Zscaler documents the supported stopgap: disable the PostgreSQL sidecar. Add this to $SPLUNK_HOME/etc/system/local/server.conf and restart:

            [postgres]
disabled = true
          

This is not free. Disabling the sidecar breaks any feature that depends on PostgreSQL, and there are three you must check for before you apply it:

• Edge Processor

• OpAmp (Open Process Control Unified Architecture Mapping)

• SPL2 data pipelines

If your deployment uses any of those, the workaround is off the table and you patch instead — there is no safe halfway. Core search, indexing, and dashboards are unaffected by disabling the sidecar, so for a plain search-and-index deployment the stopgap is genuinely usable while you schedule the upgrade.

The second control, which you should apply regardless of patch status, is network. Splunk Web on port 8000 should never be directly internet-reachable. Zscaler's recommendation is to place it behind an identity-based access layer so unauthenticated requests cannot reach the vulnerable endpoint at all. That is a compensating control, not a fix — the endpoint is still vulnerable to anyone inside your network perimeter — but it removes the internet-facing attack surface that gets instances found by mass scanners.

The 72-hour runbook

The timeline below assumes you are starting cold: you know the CVE exists and you do not yet know your exposure. Adjust the clock to your own maintenance windows, but keep the order.

Hours 0–4: scope and contain

Hours 4–24: patch the exposed, workaround the rest

Patch internet-reachable and business-critical instances first, moving to 10.4.0, 10.2.4 or 10.0.7. For instances you cannot patch inside the window, apply the [postgres] disabled = true workaround — but only after confirming the deployment does not use Edge Processor, OpAmp or SPL2 pipelines. Restart is required for the workaround to take effect.

Hours 24–48: hunt for prior compromise

A patch closes the door; it does not tell you whether someone already walked through. Because exploitation was confirmed in the wild from 18 June, assume any instance that was internet-exposed on a vulnerable build between disclosure and patch is a compromise candidate. Hunt for the artefacts the attack chain leaves:

• Unexpected files under /tmp or other writable paths, consistent with pg_dump output written via backupFile.

• Modifications to scheduled scripts, especially ssg_enable_modular_input.py under splunk_secure_gateway/bin/.

• Access to /opt/splunk/var/packages/data/postgres/.pgpass.

• POST requests to /en-US/splunkd/__raw/v1/postgres/recovery/backup or /restore in web access logs, particularly with Authorization: Basic Og==.

Hours 48–72: assume-breach cleanup where warranted

For any instance where the hunt finds indicators, treat it as a compromised host: rotate credentials that were reachable from that box, rebuild rather than clean where you can, and review indexed data for tampering. This is the step teams skip, and it is the one that matters most on a log platform — an attacker's first move after landing on Splunk is usually to suppress the alerts that would reveal the rest of their activity.

Why this one is worse than its CVSS score suggests

A 9.8 is already the top of the scale, but the business impact here is amplified by what Splunk is. It is the centralised platform where security and operational telemetry is collected, indexed and analysed. An attacker who reaches code execution on it can, in Zscaler's words, tamper with logs, suppress alerts, harvest sensitive data from indexed events, and use the host as a foothold to pivot deeper.

That changes your incident-response calculus. On most RCE bugs, the compromised host is the problem. On your SIEM, the compromised host is also the tool you would normally use to investigate every other host. If Splunk is breached, the trustworthiness of your entire detection layer is in question for the period of the compromise. That is the argument for the assume-breach cleanup step above, and for not treating "we patched" as the end of the incident.

India-specific considerations

For Indian enterprises and the managed security providers who run their SOCs, two points sharpen this.

First, CERT-In's incident-reporting rules require reporting of specified cyber incidents within six hours of detection. A confirmed compromise of a SIEM — the system holding your security telemetry — falls squarely inside that regime, so the hunt step is not only good practice, it feeds a regulatory clock. Build the reporting decision into your hours-24-to-48 phase, not after it.

Second, many Indian mid-market deployments run Splunk Enterprise on self-managed cloud VMs rather than Splunk Cloud Platform, which means they are exposed where a Cloud tenant would not be. If your telemetry includes personal data — and for most consumer-facing businesses it does — a breach of that store is also a personal-data incident under the Digital Personal Data Protection Act 2023, with its own notification expectations. The same 72 hours that fix the vulnerability are the window in which those obligations are triggered.

For teams standing up repeatable patch-and-hunt discipline around this class of bug, our note on the Oracle July 2026 Critical Patch Update triage covers the same prioritisation approach for a different vendor, the SharePoint RCE CVE-2026-50522 machine-key rotation guide walks a comparable post-exploitation cleanup, and the July 2026 Patch Tuesday enterprise triage sets out how to rank a large batch of advisories.

FAQ

How eCorpIT can help

eCorpIT runs vulnerability triage and remediation as a scoped engagement: an inventory of your Splunk estate against the affected-version matrix, a patch-or-workaround decision per instance, and a compromise hunt for the artefacts this attack chain leaves. Our engineering teams work to ISO 27001:2022 and CMMI Level 5 practices, and we design detection and response aligned with CERT-In reporting timelines. If you run self-managed Splunk Enterprise and want a second set of hands on this, talk to us.

References

1. SVD-2026-0603: Splunk PostgreSQL sidecar authentication vulnerability — Splunk Vulnerability Disclosure

1. CVE-2026-20253 detail — NVD

1. Critical unauthenticated remote code execution in Splunk Enterprise (CVE-2026-20253) — Zscaler ThreatLabz

1. Known Exploited Vulnerabilities catalog: CVE-2026-20253 — CISA

1. Splunk Enterprise vulnerability exploited in attacks days after disclosure — SecurityWeek

1. CVE-2026-20253: CISA warns of actively exploited Splunk Enterprise RCE — SOCRadar

1. Why use app-level auth when every database has auth: Splunk Enterprise CVE-2026-20253 pre-auth RCE — watchTowr Labs

1. Splunk Security Advisories archive — Splunk Vulnerability Disclosure

1. Active exploitation of critical CVE-2026-20253 in Splunk Enterprise — Rescana

1. Security bulletin: PostgreSQL sidecar service endpoint in Splunk Enterprise — RedLegg

Last updated: 6 August 2026.