CISA adds CVE-2026-20253, a critical unauthenticated remotely exploitable vulnerability in Splunk Enterprise, to its Known Exploited Vulnerabilities catalog. Both reports say the flaw is being exploited in the wild. SecurityWeek notes that CISA instructs US federal civilian agencies to apply mitigations within a short window, described as three days, after the listing. Help Net Security similarly reports a compliance deadline of June 21, 2026.
The two sources also cite confirmation of active exploitation by Splunk’s vendor and Resecurity, with Resecurity warning that successful exploitation could lead to full system compromise. Help Net Security adds that organizations should prioritize patching and review for potential indicators of compromise, including requests that contain path traversal sequences such as “../” and evidence related to PostgreSQL connection parameters.
Overall, the reports emphasize the immediacy of the threat, the lack of authentication required for exploitation, and the expectation that agencies move quickly to patch Splunk Enterprise systems and check for signs of malicious activity tied to attempts exploiting CVE-2026-20253.
