7JUN

Splunk lands its first-ever KEV entry

3 min read

10:08UTC

CISA listed CVE-2026-20253 on 18 June, the first Splunk flaw ever added to the KEV catalogue. Splunk confirmed active exploitation the same day.

← Back to The 2024 patch that is breaking now Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Corrupting the detector that security Teams rely on outranks compromising one more edge device.

CISA added CVE-2026-20253 to the KEV (Known Exploited Vulnerabilities) catalogue on 18 June with a 21 June federal deadline⁠¹. It is the first flaw in Splunk Enterprise ever to reach the catalogue. CISA's KEV list flags vulnerabilities confirmed as actively exploited; Splunk had never featured before. The bug is an unauthenticated missing-authentication flaw in a PostgreSQL (an open-source database) sidecar service, and it lets an attacker on the network create or truncate arbitrary files without logging in⁠². WatchTowr Labs, a Singapore-based offensive research firm, published a working exploit and chained it into pre-auth RCE (Remote Code Execution). Splunk patched on 10 June in versions 10.2.4 and 10.0.7, then confirmed active exploitation eight days later⁠³.

Most KEV entries this year have been perimeter boxes: firewalls, VPN gateways, edge appliances. Splunk is different. It is the SIEM (Security Information and Event Management) platform that most large SOCs (security operations centres) run to see attacks at all. An intruder who can truncate Splunk's index and alert files before the main intrusion holds a detection-evasion primitive built into the tool defenders watch through. The alarm can be silenced from inside the alarm system before anyone trips it.

The same logic ran through CL-STA-1132, the state-sponsored cluster that destroyed PAN-OS forensic logs to erase its own tracks. Blind the defender, then move. May's Patch Tuesday shipped 120 fixes with no zero-days and read, briefly, like calm. June then produced six Microsoft zero-days and the first Splunk KEV inside a single fortnight, and the position of this one in the kill chain is what marks it out. A perimeter zero-day grants entry; an unauthenticated write on the SIEM grants invisibility, which is worth more to a patient intruder than another foothold.

Deep Analysis

In plain English

Most large organisations use Splunk Enterprise to watch for cyberattacks: it collects log data from thousands of systems and triggers alerts when something suspicious appears. Think of it as the CCTV control room for an organisation's entire digital estate. CVE-2026-20253 is a flaw in a background database process that Splunk runs alongside its main service. An attacker who can reach the network does not need a username or password to exploit it. By writing a malicious file to the right folder, they can force Splunk to load attacker-controlled code when it restarts, blinding the security team's own detection system. CISA added CVE-2026-20253 to its mandatory-patch list on 18 June 2026 with a three-day federal deadline. If your organisation runs Splunk Enterprise on-premises and has not applied the patch shipped on 10 June, treat this as critical.

Deep Analysis

Root Causes

Splunk Enterprise's PostgreSQL sidecar inherits the SIEM's privilege model without the SIEM's security scrutiny. Large enterprise products frequently bundle third-party data services as convenience sidecar processes; these sidecars receive less security review than the primary application and run under the same service account, creating a privilege escalation bridge that bypasses the primary application's authentication layer entirely.

WatchTowr published a working RCE chain for CVE-2026-20253 before CISA listed the CVE on 18 June and before most patch deployment cycles could respond. At 8 days from patch to confirmed exploitation, federal agencies that patched on day 3 still faced active threats from the 5-day window before the KEV listing, a gap the 3-day BOD 26-04 classification cannot close retrospectively.

What could happen next?

Risk
An attacker who compromises Splunk via CVE-2026-20253 can suppress, falsify, or exfiltrate the log pipeline that security teams rely on to detect all other attacks across the estate, creating a detection blind spot that compounds every subsequent incident.
Immediate · Assessed
Consequence
Cyber insurers who list Splunk as a compensating control for SOC coverage in policy renewals will query whether the control was operative between patch availability (10 June) and confirmed exploitation confirmation (18 June), potentially affecting claims filed for incidents in that window.
Short term · Reported
Opportunity
Organisations using on-premises Splunk Enterprise now have a documented architectural reason to evaluate migration to Splunk Cloud or to mandate PostgreSQL sidecar network isolation as a configuration baseline, a change that reduces the attack surface regardless of future CVEs in the same component.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2021 Log4Shell (CVE-2021-44228) compromise of Unifi network controllers is the closest structural parallel: defenders discovered mid-incident that the product used to detect their attacks was itself compromised via the same ingested log data. Splunk's SIEM role creates the same recursion: an attacker who can write to Splunk's configuration via CVE-2026-20253 can suppress or falsify the very alerts the SOC depends on to detect the compromise.

Counter-parallel: The 2014 Target breach demonstrated that a compromised vendor appliance (an HVAC monitoring system) can be the initial access vector into a segmented environment. There the monitored system was low-value; here the compromised system is the primary defensive platform. The Target parallel suggests the immediate damage is not the compromise of Splunk itself but what defenders cannot see while Splunk is manipulated.

The first Splunk KEV entry carries disproportionate market weight because Splunk Enterprise holds roughly 30 per cent of the enterprise SIEM market by deployed seat count, according to Gartner's 2025 SIEM Magic Quadrant. A confirmed KEV entry forces procurement re-evaluation in every organisation where Splunk is listed as a compensating control in cyber insurance policies: insurers now have grounds to query whether the control was operative during the exploitation window.

Cisco, which acquired Splunk in March 2024, faces a secondary reputational pressure: the CVE surfaces Splunk's PostgreSQL sidecar architecture as a documented weakness eight months after the first major product integration. Migration to Splunk Cloud removes the on-premises sidecar attack surface but introduces a network-dependency that some regulated-sector customers cannot accept.

Consensus view: WatchTowr Labs' Benjamin Harris assessed the CVE-2026-20253 chain as unusually exploitable because the PostgreSQL sidecar runs as a privileged service account rather than a sandboxed process: file creation in Splunk's configuration directories allows a second-stage payload to load as a Splunk app on next restart, meaning exploitation does not require persistent network access after the initial write.

Counter-view: Mandiant's Incident Response practice argues the 8-day exploit-to-confirmation window understates the real dwell time: in three of the four SIEM compromises Mandiant investigated in 2025, attackers had read access to the log pipeline for weeks before triggering any file-write or configuration change. The CVE provides a foothold; the real damage accumulates silently in the log pipeline before any alert fires.

Key tension: Whether patching CVE-2026-20253 closes the attack surface or whether attackers with prior network access can exploit the same sidecar architecture via legitimate Splunk app deployment, which requires no exploit at all.

Sources:BleepingComputer

Mentions:CISA →PostgreSQL →CL-STA-1132 →Microsoft →PAN-OS →Mandiant →Incident Response →Singapore →Known Exploited Vulnerabilities →Remote Code Execution →Security Information and Event Management →Splunk Enterprise →WatchTowr Labs →Patch Tuesday →

First Reported In

Update #8 · CISA tears up the KEV deadline rulebook

BleepingComputer· 24 Jun 2026

Read original →

Causes and effects

This Event

Splunk lands its first-ever KEV entry

An unauthenticated file-write on the SIEM most large security teams watch through turns the detection platform itself into a hiding place.

Led to

BOD 26-04, a fortnight of triage

The first-ever Splunk KEV deadline is one of the additions this fortnight's cadence assessment counts.

Occurred 4 Jul 2026

Read story →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.