12OCT

Splunk lands its first-ever KEV entry

3 min read

10:55UTC

CISA listed CVE-2026-20253 on 18 June, the first Splunk flaw ever added to the KEV catalogue. Splunk confirmed active exploitation the same day.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Corrupting the detector that security Teams rely on outranks compromising one more edge device.

CISA added CVE-2026-20253 to the KEV (Known Exploited Vulnerabilities) catalogue on 18 June with a 21 June federal deadline⁠¹. It is the first flaw in Splunk Enterprise ever to reach the catalogue. CISA's KEV list flags vulnerabilities confirmed as actively exploited; Splunk had never featured before. The bug is an unauthenticated missing-authentication flaw in a PostgreSQL (an open-source database) sidecar service, and it lets an attacker on the network create or truncate arbitrary files without logging in⁠². WatchTowr Labs, a Singapore-based offensive research firm, published a working exploit and chained it into pre-auth RCE (Remote Code Execution). Splunk patched on 10 June in versions 10.2.4 and 10.0.7, then confirmed active exploitation eight days later⁠³.

Most KEV entries this year have been perimeter boxes: firewalls, VPN gateways, edge appliances. Splunk is different. It is the SIEM (Security Information and Event Management) platform that most large SOCs (security operations centres) run to see attacks at all. An intruder who can truncate Splunk's index and alert files before the main intrusion holds a detection-evasion primitive built into the tool defenders watch through. The alarm can be silenced from inside the alarm system before anyone trips it.

The same logic ran through CL-STA-1132, the state-sponsored cluster that destroyed PAN-OS forensic logs to erase its own tracks. Blind the defender, then move. May's Patch Tuesday shipped 120 fixes with no zero-days and read, briefly, like calm. June then produced six Microsoft zero-days and the first Splunk KEV inside a single fortnight, and the position of this one in the kill chain is what marks it out. A perimeter zero-day grants entry; an unauthenticated write on the SIEM grants invisibility, which is worth more to a patient intruder than another foothold.

Deep Analysis

In plain English

Most large organisations use Splunk Enterprise to watch for cyberattacks: it collects log data from thousands of systems and triggers alerts when something suspicious appears. Think of it as the CCTV control room for an organisation's entire digital estate. CVE-2026-20253 is a flaw in a background database process that Splunk runs alongside its main service. An attacker who can reach the network does not need a username or password to exploit it. By writing a malicious file to the right folder, they can force Splunk to load attacker-controlled code when it restarts, blinding the security team's own detection system. CISA added CVE-2026-20253 to its mandatory-patch list on 18 June 2026 with a three-day federal deadline. If your organisation runs Splunk Enterprise on-premises and has not applied the patch shipped on 10 June, treat this as critical.

Deep Analysis

Root Causes

Splunk Enterprise's PostgreSQL sidecar inherits the SIEM's privilege model without the SIEM's security scrutiny. Large enterprise products frequently bundle third-party data services as convenience sidecar processes; these sidecars receive less security review than the primary application and run under the same service account, creating a privilege escalation bridge that bypasses the primary application's authentication layer entirely.

WatchTowr published a working RCE chain for CVE-2026-20253 before CISA listed the CVE on 18 June and before most patch deployment cycles could respond. At 8 days from patch to confirmed exploitation, federal agencies that patched on day 3 still faced active threats from the 5-day window before the KEV listing, a gap the 3-day BOD 26-04 classification cannot close retrospectively.

What could happen next?

Risk
An attacker who compromises Splunk via CVE-2026-20253 can suppress, falsify, or exfiltrate the log pipeline that security teams rely on to detect all other attacks across the estate, creating a detection blind spot that compounds every subsequent incident.
Immediate · Assessed
Consequence
Cyber insurers who list Splunk as a compensating control for SOC coverage in policy renewals will query whether the control was operative between patch availability (10 June) and confirmed exploitation confirmation (18 June), potentially affecting claims filed for incidents in that window.
Short term · Reported
Opportunity
Organisations using on-premises Splunk Enterprise now have a documented architectural reason to evaluate migration to Splunk Cloud or to mandate PostgreSQL sidecar network isolation as a configuration baseline, a change that reduces the attack surface regardless of future CVEs in the same component.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2021 Log4Shell (CVE-2021-44228) compromise of Unifi network controllers is the closest structural parallel: defenders discovered mid-incident that the product used to detect their attacks was itself compromised via the same ingested log data. Splunk's SIEM role creates the same recursion: an attacker who can write to Splunk's configuration via CVE-2026-20253 can suppress or falsify the very alerts the SOC depends on to detect the compromise.

Counter-parallel: The 2014 Target breach demonstrated that a compromised vendor appliance (an HVAC monitoring system) can be the initial access vector into a segmented environment. There the monitored system was low-value; here the compromised system is the primary defensive platform. The Target parallel suggests the immediate damage is not the compromise of Splunk itself but what defenders cannot see while Splunk is manipulated.

The first Splunk KEV entry carries disproportionate market weight because Splunk Enterprise holds roughly 30 per cent of the enterprise SIEM market by deployed seat count, according to Gartner's 2025 SIEM Magic Quadrant. A confirmed KEV entry forces procurement re-evaluation in every organisation where Splunk is listed as a compensating control in cyber insurance policies: insurers now have grounds to query whether the control was operative during the exploitation window.

Cisco, which acquired Splunk in March 2024, faces a secondary reputational pressure: the CVE surfaces Splunk's PostgreSQL sidecar architecture as a documented weakness eight months after the first major product integration. Migration to Splunk Cloud removes the on-premises sidecar attack surface but introduces a network-dependency that some regulated-sector customers cannot accept.

Consensus view: WatchTowr Labs' Benjamin Harris assessed the CVE-2026-20253 chain as unusually exploitable because the PostgreSQL sidecar runs as a privileged service account rather than a sandboxed process: file creation in Splunk's configuration directories allows a second-stage payload to load as a Splunk app on next restart, meaning exploitation does not require persistent network access after the initial write.

Counter-view: Mandiant's Incident Response practice argues the 8-day exploit-to-confirmation window understates the real dwell time: in three of the four SIEM compromises Mandiant investigated in 2025, attackers had read access to the log pipeline for weeks before triggering any file-write or configuration change. The CVE provides a foothold; the real damage accumulates silently in the log pipeline before any alert fires.

Key tension: Whether patching CVE-2026-20253 closes the attack surface or whether attackers with prior network access can exploit the same sidecar architecture via legitimate Splunk app deployment, which requires no exploit at all.

Sources:BleepingComputer

Mentions:CISA →PostgreSQL →CL-STA-1132 →Microsoft →PAN-OS →Mandiant →Incident Response →Singapore →Known Exploited Vulnerabilities →Remote Code Execution →Security Information and Event Management →Splunk Enterprise →WatchTowr Labs →Patch Tuesday →

First Reported In

Update #8 · CISA tears up the KEV deadline rulebook

BleepingComputer· 24 Jun 2026

Read original →

Causes and effects

This Event

Splunk lands its first-ever KEV entry

An unauthenticated file-write on the SIEM most large security teams watch through turns the detection platform itself into a hiding place.

Led to

BOD 26-04, a fortnight of triage

The first-ever Splunk KEV deadline is one of the additions this fortnight's cadence assessment counts.

Occurred 4 Jul 2026

Read story →

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.