5SEP

Splunk lands its first-ever KEV entry

3 min read

12:09UTC

CISA listed CVE-2026-20253 on 18 June, the first Splunk flaw ever added to the KEV catalogue. Splunk confirmed active exploitation the same day.

← Back to Four privileged platforms under live attack Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Corrupting the detector that security teams rely on outranks compromising one more edge device.

CISA added CVE-2026-20253 to the KEV (Known Exploited Vulnerabilities) catalogue on 18 June with a 21 June federal deadline ¹. It is the first flaw in Splunk Enterprise ever to reach the catalogue. CISA's KEV list flags vulnerabilities confirmed as actively exploited; Splunk had never featured before. The bug is an unauthenticated missing-authentication flaw in a PostgreSQL (an open-source database) sidecar service, and it lets an attacker on the network create or truncate arbitrary files without logging in ². WatchTowr Labs, a Singapore-based offensive research firm, published a working exploit and chained it into pre-auth RCE (Remote Code Execution). Splunk patched on 10 June in versions 10.2.4 and 10.0.7, then confirmed active exploitation eight days later ³.

Most KEV entries this year have been perimeter boxes: firewalls, VPN gateways, edge appliances. Splunk is different. It is the SIEM (Security Information and Event Management) platform that most large SOCs (security operations centres) run to see attacks at all. An intruder who can truncate Splunk's index and alert files before the main intrusion holds a detection-evasion primitive built into the tool defenders watch through. The alarm can be silenced from inside the alarm system before anyone trips it.

The same logic ran through CL-STA-1132, the state-sponsored cluster that destroyed PAN-OS forensic logs to erase its own tracks . Blind the defender, then move. May's Patch Tuesday shipped 120 fixes with no zero-days and read, briefly, like calm . June then produced six Microsoft zero-days and the first Splunk KEV inside a single fortnight, and the position of this one in the kill chain is what marks it out. A perimeter zero-day grants entry; an unauthenticated write on the SIEM grants invisibility, which is worth more to a patient intruder than another foothold.

Deep Analysis

In plain English

Most large organisations use Splunk Enterprise to watch for cyberattacks: it collects log data from thousands of systems and triggers alerts when something suspicious appears. Think of it as the CCTV control room for an organisation's entire digital estate. CVE-2026-20253 is a flaw in a background database process that Splunk runs alongside its main service. An attacker who can reach the network does not need a username or password to exploit it. By writing a malicious file to the right folder, they can force Splunk to load attacker-controlled code when it restarts, blinding the security team's own detection system. CISA added CVE-2026-20253 to its mandatory-patch list on 18 June 2026 with a three-day federal deadline. If your organisation runs Splunk Enterprise on-premises and has not applied the patch shipped on 10 June, treat this as critical.

Deep Analysis

Root Causes

Splunk Enterprise's PostgreSQL sidecar inherits the SIEM's privilege model without the SIEM's security scrutiny. Large enterprise products frequently bundle third-party data services as convenience sidecar processes; these sidecars receive less security review than the primary application and run under the same service account, creating a privilege escalation bridge that bypasses the primary application's authentication layer entirely.

WatchTowr published a working RCE chain for CVE-2026-20253 before CISA listed the CVE on 18 June and before most patch deployment cycles could respond. At 8 days from patch to confirmed exploitation, federal agencies that patched on day 3 still faced active threats from the 5-day window before the KEV listing, a gap the 3-day BOD 26-04 classification cannot close retrospectively.

What could happen next?

Risk
An attacker who compromises Splunk via CVE-2026-20253 can suppress, falsify, or exfiltrate the log pipeline that security teams rely on to detect all other attacks across the estate, creating a detection blind spot that compounds every subsequent incident.
Immediate · Assessed
Consequence
Cyber insurers who list Splunk as a compensating control for SOC coverage in policy renewals will query whether the control was operative between patch availability (10 June) and confirmed exploitation confirmation (18 June), potentially affecting claims filed for incidents in that window.
Short term · Reported
Opportunity
Organisations using on-premises Splunk Enterprise now have a documented architectural reason to evaluate migration to Splunk Cloud or to mandate PostgreSQL sidecar network isolation as a configuration baseline, a change that reduces the attack surface regardless of future CVEs in the same component.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2021 Log4Shell (CVE-2021-44228) compromise of Unifi network controllers is the closest structural parallel: defenders discovered mid-incident that the product used to detect their attacks was itself compromised via the same ingested log data. Splunk's SIEM role creates the same recursion: an attacker who can write to Splunk's configuration via CVE-2026-20253 can suppress or falsify the very alerts the SOC depends on to detect the compromise.

Counter-parallel: The 2014 Target breach demonstrated that a compromised vendor appliance (an HVAC monitoring system) can be the initial access vector into a segmented environment. There the monitored system was low-value; here the compromised system is the primary defensive platform. The Target parallel suggests the immediate damage is not the compromise of Splunk itself but what defenders cannot see while Splunk is manipulated.

The first Splunk KEV entry carries disproportionate market weight because Splunk Enterprise holds roughly 30 per cent of the enterprise SIEM market by deployed seat count, according to Gartner's 2025 SIEM Magic Quadrant. A confirmed KEV entry forces procurement re-evaluation in every organisation where Splunk is listed as a compensating control in cyber insurance policies: insurers now have grounds to query whether the control was operative during the exploitation window.

Cisco, which acquired Splunk in March 2024, faces a secondary reputational pressure: the CVE surfaces Splunk's PostgreSQL sidecar architecture as a documented weakness eight months after the first major product integration. Migration to Splunk Cloud removes the on-premises sidecar attack surface but introduces a network-dependency that some regulated-sector customers cannot accept.

Consensus view: WatchTowr Labs' Benjamin Harris assessed the CVE-2026-20253 chain as unusually exploitable because the PostgreSQL sidecar runs as a privileged service account rather than a sandboxed process: file creation in Splunk's configuration directories allows a second-stage payload to load as a Splunk app on next restart, meaning exploitation does not require persistent network access after the initial write.

Counter-view: Mandiant's Incident Response practice argues the 8-day exploit-to-confirmation window understates the real dwell time: in three of the four SIEM compromises Mandiant investigated in 2025, attackers had read access to the log pipeline for weeks before triggering any file-write or configuration change. The CVE provides a foothold; the real damage accumulates silently in the log pipeline before any alert fires.

Key tension: Whether patching CVE-2026-20253 closes the attack surface or whether attackers with prior network access can exploit the same sidecar architecture via legitimate Splunk app deployment, which requires no exploit at all.

Sources:BleepingComputer

Mentions:CISA →PostgreSQL →CL-STA-1132 →Microsoft →PAN-OS →Mandiant →Incident Response →Singapore →Known Exploited Vulnerabilities →Remote Code Execution →Security Information and Event Management →Splunk Enterprise →WatchTowr Labs →

First Reported In

Update #8 · CISA tears up the KEV deadline rulebook

BleepingComputer· 24 Jun 2026

Read original →

Causes and effects

This Event

Splunk lands its first-ever KEV entry

An unauthenticated file-write on the SIEM most large security teams watch through turns the detection platform itself into a hiding place.

Led to

BOD 26-04, a fortnight of triage

The first-ever Splunk KEV deadline is one of the additions this fortnight's cadence assessment counts.

Occurred 4 Jul 2026

Read story →

Different Perspectives

ENISA

ENISA published an SME cyber-resilience maturity model on 6 August and updated the Cyber Resilience Act reporting-platform FAQ on 31 August. The agency supplies common implementation tools for smaller operators, but it cannot fine organisations that do not use them.

UAE Cyber Security Council

On 10 August, the UAE Cyber Security Council said national teams contained attacks on aviation, energy and education before objectives were reached. Its second monthly statement, after a 3 July financial-sector disclosure, makes public reporting of stopped attacks part of its operating posture.

South African authorities

INTERPOL said on 25 August that South African authorities made 39 arrests, seized US$2.67 million and blocked 257 accounts during Operation Jackal IV. Their share of the 23-country operation shows the material enforcement burden in a cross-border fraud case.

Europol

On 2 September, Europol announced the sinkholing of Sality after a 31 August operation involving US, Bulgarian, Hungarian and Romanian authorities. Its more than 11 million linked IP addresses measure infrastructure contact, not confirmed victims, and show why technical partners joined the action.

CISA

From 3 August to 2 September, CISA recorded three-day deadlines for 24 of 37 KEV additions, compared with 34 of 39 from 10 June to 29 July. The falling share changes the urgency signal that US federal agencies and private-sector tooling draw from the catalogue.

Beacon

On 3 September, Beacon said its final report found that an intruder likely exported its customer database during roughly one hour and 27 minutes on 27 July. Charities using the CRM now have a named exposure route, a compromised AWS access key in public build artefacts.