CISA orders federal agencies to patch exploited Splunk flaw by 21 June

A critical security vulnerability in Splunk Enterprise is under active exploitation, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue an urgent patching directive to federal agencies. The flaw, tracked as CVE-2026-20253, affects versions 10.2.0 to 10.2.3 and 10.0.0 to 10.0.6 of the platform, enabling remote attackers to create or truncate arbitrary files without authentication via a misconfigured PostgreSQL sidecar service endpoint.

What happened

Splunk disclosed the vulnerability on 12 June 2026, releasing patches for affected versions. Within days, security research group WatchTowr published a technical analysis and proof-of-concept exploit code, warning that the flaw could be leveraged for remote code execution. On 18 June, Splunk updated its advisory to confirm limited in-the-wild exploitation, urging customers to apply fixes immediately.

CISA responded on 19 June by adding CVE-2026-20253 to its Known Exploited Vulnerabilities Catalog and issuing Binding Operational Directive (BOD) 26-04, which requires Federal Civilian Executive Branch (FCEB) agencies to secure their Splunk instances by 21 June. The directive cites the vulnerability’s high risk of exploitation and its potential to compromise federal systems.

Why it matters

The vulnerability’s low attack complexity—requiring no authentication—makes it particularly dangerous. Shadowserver, an internet security monitoring group, reports over 1,400 internet-exposed Splunk instances globally, with the majority located in North America (952) and Europe (223). While it remains unclear how many of these are vulnerable, the public availability of exploit code increases the risk of widespread attacks.

Splunk’s advisory highlights that disabling the PostgreSQL sidecar service can mitigate the flaw but warns this action will break Edge Processor, OpAmp, or SPL2 data pipelines on affected instances. This trade-off may complicate patching decisions for organizations reliant on these features.

What to watch

Federal agencies must prioritize patching by the 21 June deadline to comply with CISA’s directive. Private sector organizations, particularly those in critical infrastructure, are also advised to assess their exposure and apply updates promptly. Security teams should monitor for unusual file modifications or unauthorized access attempts, as these may indicate exploitation attempts.