24JUL

Splunk lands its first-ever KEV entry

3 min read

18:20UTC

CISA listed CVE-2026-20253 on 18 June, the first Splunk flaw ever added to the KEV catalogue. Splunk confirmed active exploitation the same day.

← Back to Zimbra zero-click, and a 15-nation reply Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Corrupting the detector that security teams rely on outranks compromising one more edge device.

CISA added CVE-2026-20253 to the KEV (Known Exploited Vulnerabilities) catalogue on 18 June with a 21 June federal deadline ¹. It is the first flaw in Splunk Enterprise ever to reach the catalogue. CISA's KEV list flags vulnerabilities confirmed as actively exploited; Splunk had never featured before. The bug is an unauthenticated missing-authentication flaw in a PostgreSQL (an open-source database) sidecar service, and it lets an attacker on the network create or truncate arbitrary files without logging in ². WatchTowr Labs, a Singapore-based offensive research firm, published a working exploit and chained it into pre-auth RCE (Remote Code Execution). Splunk patched on 10 June in versions 10.2.4 and 10.0.7, then confirmed active exploitation eight days later ³.

Most KEV entries this year have been perimeter boxes: firewalls, VPN gateways, edge appliances. Splunk is different. It is the SIEM (Security Information and Event Management) platform that most large SOCs (security operations centres) run to see attacks at all. An intruder who can truncate Splunk's index and alert files before the main intrusion holds a detection-evasion primitive built into the tool defenders watch through. The alarm can be silenced from inside the alarm system before anyone trips it.

The same logic ran through CL-STA-1132, the state-sponsored cluster that destroyed PAN-OS forensic logs to erase its own tracks . Blind the defender, then move. May's Patch Tuesday shipped 120 fixes with no zero-days and read, briefly, like calm . June then produced six Microsoft zero-days and the first Splunk KEV inside a single fortnight, and the position of this one in the kill chain is what marks it out. A perimeter zero-day grants entry; an unauthenticated write on the SIEM grants invisibility, which is worth more to a patient intruder than another foothold.

Deep Analysis

In plain English

Most large organisations use Splunk Enterprise to watch for cyberattacks: it collects log data from thousands of systems and triggers alerts when something suspicious appears. Think of it as the CCTV control room for an organisation's entire digital estate. CVE-2026-20253 is a flaw in a background database process that Splunk runs alongside its main service. An attacker who can reach the network does not need a username or password to exploit it. By writing a malicious file to the right folder, they can force Splunk to load attacker-controlled code when it restarts, blinding the security team's own detection system. CISA added CVE-2026-20253 to its mandatory-patch list on 18 June 2026 with a three-day federal deadline. If your organisation runs Splunk Enterprise on-premises and has not applied the patch shipped on 10 June, treat this as critical.

Deep Analysis

Root Causes

Splunk Enterprise's PostgreSQL sidecar inherits the SIEM's privilege model without the SIEM's security scrutiny. Large enterprise products frequently bundle third-party data services as convenience sidecar processes; these sidecars receive less security review than the primary application and run under the same service account, creating a privilege escalation bridge that bypasses the primary application's authentication layer entirely.

WatchTowr published a working RCE chain for CVE-2026-20253 before CISA listed the CVE on 18 June and before most patch deployment cycles could respond. At 8 days from patch to confirmed exploitation, federal agencies that patched on day 3 still faced active threats from the 5-day window before the KEV listing, a gap the 3-day BOD 26-04 classification cannot close retrospectively.

What could happen next?

Risk
An attacker who compromises Splunk via CVE-2026-20253 can suppress, falsify, or exfiltrate the log pipeline that security teams rely on to detect all other attacks across the estate, creating a detection blind spot that compounds every subsequent incident.
Immediate · Assessed
Consequence
Cyber insurers who list Splunk as a compensating control for SOC coverage in policy renewals will query whether the control was operative between patch availability (10 June) and confirmed exploitation confirmation (18 June), potentially affecting claims filed for incidents in that window.
Short term · Reported
Opportunity
Organisations using on-premises Splunk Enterprise now have a documented architectural reason to evaluate migration to Splunk Cloud or to mandate PostgreSQL sidecar network isolation as a configuration baseline, a change that reduces the attack surface regardless of future CVEs in the same component.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2021 Log4Shell (CVE-2021-44228) compromise of Unifi network controllers is the closest structural parallel: defenders discovered mid-incident that the product used to detect their attacks was itself compromised via the same ingested log data. Splunk's SIEM role creates the same recursion: an attacker who can write to Splunk's configuration via CVE-2026-20253 can suppress or falsify the very alerts the SOC depends on to detect the compromise.

Counter-parallel: The 2014 Target breach demonstrated that a compromised vendor appliance (an HVAC monitoring system) can be the initial access vector into a segmented environment. There the monitored system was low-value; here the compromised system is the primary defensive platform. The Target parallel suggests the immediate damage is not the compromise of Splunk itself but what defenders cannot see while Splunk is manipulated.

The first Splunk KEV entry carries disproportionate market weight because Splunk Enterprise holds roughly 30 per cent of the enterprise SIEM market by deployed seat count, according to Gartner's 2025 SIEM Magic Quadrant. A confirmed KEV entry forces procurement re-evaluation in every organisation where Splunk is listed as a compensating control in cyber insurance policies: insurers now have grounds to query whether the control was operative during the exploitation window.

Cisco, which acquired Splunk in March 2024, faces a secondary reputational pressure: the CVE surfaces Splunk's PostgreSQL sidecar architecture as a documented weakness eight months after the first major product integration. Migration to Splunk Cloud removes the on-premises sidecar attack surface but introduces a network-dependency that some regulated-sector customers cannot accept.

Consensus view: WatchTowr Labs' Benjamin Harris assessed the CVE-2026-20253 chain as unusually exploitable because the PostgreSQL sidecar runs as a privileged service account rather than a sandboxed process: file creation in Splunk's configuration directories allows a second-stage payload to load as a Splunk app on next restart, meaning exploitation does not require persistent network access after the initial write.

Counter-view: Mandiant's Incident Response practice argues the 8-day exploit-to-confirmation window understates the real dwell time: in three of the four SIEM compromises Mandiant investigated in 2025, attackers had read access to the log pipeline for weeks before triggering any file-write or configuration change. The CVE provides a foothold; the real damage accumulates silently in the log pipeline before any alert fires.

Key tension: Whether patching CVE-2026-20253 closes the attack surface or whether attackers with prior network access can exploit the same sidecar architecture via legitimate Splunk app deployment, which requires no exploit at all.

Sources:BleepingComputer

Mentions:CISA →PostgreSQL →CL-STA-1132 →Microsoft →PAN-OS →Mandiant →Incident Response →Singapore →Known Exploited Vulnerabilities →Remote Code Execution →Security Information and Event Management →Splunk Enterprise →WatchTowr Labs →

First Reported In

Update #8 · CISA tears up the KEV deadline rulebook

BleepingComputer· 24 Jun 2026

Read original →

Causes and effects

This Event

Splunk lands its first-ever KEV entry

An unauthenticated file-write on the SIEM most large security teams watch through turns the detection platform itself into a hiding place.

Led to

BOD 26-04, a fortnight of triage

The first-ever Splunk KEV deadline is one of the additions this fortnight's cadence assessment counts.

Occurred 4 Jul 2026

Read story →

Different Perspectives

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.

CNCERT

China's national CERT was not party to AA26-204A and has previously argued that Western KEV-based advisories conflate demonstrated exploit capability with confirmed breach impact. It is expected to treat this fortnight's coalition-based Russia attribution as a Five Eyes-led exercise rather than an independently verified finding.

Russia

Moscow has not publicly responded to the AA26-204A attribution naming LAUNDRY BEAR as a Russian state-supported actor behind the Zimbra zero-click chain. Russian officials have consistently denied state involvement in prior Western cyber-attribution advisories, a pattern this fifteen-agency coalition is likely to meet with the same denial.

National Crime Agency

The NCA called the Woolwich Crown Court sentencing of Owen Flowers and Thalha Jubair Britain's largest-ever cybercrime prosecution. It expects continued pressure on Scattered Spider's UK-linked membership, alongside City of London Police's push for statutory Cyber Crime Risk Orders.

CISA

CISA co-led AA26-204A naming LAUNDRY BEAR and added five more flaws to KEV this fortnight, including a three-day Oracle EBS deadline, while absorbing a one-month detection-to-listing gap on FortiSandbox. It expects the risk-tiered BOD 26-04 model to hold even as a proposed $707m FY27 cut threatens the staffing behind it.

UK managed service providers and data centre operators

Newly brought into critical-infrastructure scope by the Cyber Security and Resilience Bill's Lords second reading, facing fines up to £17m or 4% of global turnover and a new near-miss reporting duty they did not previously carry. The sector moves from best-practice guidance to statutory exposure within this Parliamentary session.