Splunk Enterprise & Cloud Platform - Unrestricted File Upload

Exploited in the wild. Listed by CISA on 2026-06-18; known to be used by ransomware.

criticalseverity

96.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.

Impact

Unauthenticated attackers can create or truncate arbitrary files, potentially leading to data loss or system compromise.

Fix

Upgrade to Splunk Enterprise 10.2.4, 10.0.7 and Splunk Cloud Platform 10.4.2604.3, 10.2.2510.14 or later.

How to confirm it

Send: POST /{{region}}/splunkd/__raw/v1/postgres/recovery/backup
Positive when: contains "Failed to decode" AND status 400

Run it with nuclei: nuclei -id CVE-2026-20253 -u <target>

The full check

id: CVE-2026-20253

info:
  name: Splunk Enterprise & Cloud Platform - Unrestricted File Upload
  author: watchtowrlabs,DhiyaneshDk
  severity: critical
  description: |
    In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.
  impact: |
    Unauthenticated attackers can create or truncate arbitrary files, potentially leading to data loss or system compromise.
  remediation: |
    Upgrade to Splunk Enterprise 10.2.4, 10.0.7 and Splunk Cloud Platform 10.4.2604.3, 10.2.2510.14 or later.
  reference:
    - https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/
    - https://github.com/watchtowrlabs/watchTowr-vs-Splunk-CVE-2026-20253/blob/main/watchTowr-vs-Splunk-CVE-2026-20253.py
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="enterprise" && body="splunk"
  tags: cve,cve2026,splunk,postgres,backup,vkev,kev

http:
  - raw:
      - |
        POST /{{region}}/splunkd/__raw/v1/postgres/recovery/backup HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic ZGFnOg==

    payloads:
      region:
        - "en-US"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Failed to decode"

      - type: status
        status:
          - 400

References

Use this check only on systems you are authorised to test. Where the data comes from