Critical Splunk Enterprise Bugs Let Attackers Run Malicious Code

Key Takeaways

• Splunk Enterprise is affected by multiple critical and high-severity vulnerabilities.
• The most critical flaw (CVE-2026-20253) allows unauthenticated attackers to create or truncate files, potentially leading to full system compromise.
• Other vulnerabilities include stored XSS, SSRF, and various input validation issues that could lead to data exfiltration or arbitrary code execution.
• Patches are available for Splunk Enterprise versions 10.4.0, 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and corresponding Splunk Cloud Platform versions.

Splunk Enterprise, a widely adopted platform for security information and event management (SIEM) and operational intelligence, faces a series of critical and high-severity vulnerabilities. Disclosed on June 10, 2026, these security flaws could allow attackers to execute arbitrary code, steal sensitive data, and manipulate files within affected systems.

The most severe of these, identified as CVE-2026-20253, has received a CVSS score of 9.8, categorizing it as critical. This particular vulnerability impacts Splunk Enterprise installations running versions prior to 10.2.4 and 10.0.7.

At its core, CVE-2026-20253 is an authentication bypass within a PostgreSQL sidecar service endpoint. This flaw permits unauthenticated adversaries to either create new files or truncate existing ones without needing any prior authorization.

The implications of this vulnerability are profound, potentially leading to complete system compromise, irreversible data destruction, or the establishment of persistent malicious code within the environment, all without requiring any user interaction.

Another significant vulnerability, CVE-2026-20258, is a high-severity stored cross-site scripting (XSS) flaw found in classic dashboards, scoring 7.1 on the CVSS scale.

Additional High and Medium Severity Flaws

This XSS vulnerability allows an attacker with low privileges to embed malicious JavaScript within HTML panels of classic dashboards. When a victim subsequently views the compromised dashboard, the injected script executes within their browser. However, successful exploitation typically relies on social engineering tactics, compelling users to interact with a specially crafted request.

Splunk also addressed CVE-2026-20252, a server-side request forgery (SSRF) vulnerability with a CVSS score of 7.6. This flaw resides in the Dashboard Studio PDF export feature.

Attackers can exploit this SSRF by bypassing domain validation through the use of carefully constructed subdomains or redirect chains. This could expose internal systems or sensitive data to external adversaries.

Several medium-severity vulnerabilities were also disclosed (CVE-2026-20254, CVE-2026-20255, CVE-2026-20256, and CVE-2026-20257), all stemming from inadequate input validation within classic dashboards.

These issues facilitate data exfiltration through methods such as CSS injection, protocol-relative URLs, and insufficient validation of external content. In these scenarios, a low-privileged attacker can design malicious dashboards capable of extracting sensitive data when accessed by users with higher privileges.

For instance, an attacker could embed a hidden request within a dashboard that silently transmits sensitive session data or authentication tokens to an attacker-controlled server when an administrator views the dashboard.

Most of these vulnerabilities primarily affect Splunk Web components and often necessitate some level of user interaction or specific configurations, such as enabling embeddable HTML content or loosely defined trusted domains. Splunk has released patches for all supported versions.

What You Should Do

• Upgrade Immediately: Apply the latest patches by upgrading to Splunk Enterprise 10.4.0, 10.2.4, 10.0.7, 9.4.12, or 9.3.13, or the corresponding Splunk Cloud Platform versions.
• Disable Unnecessary Components: Disable Splunk Web if it is not actively required for operations.
• Restrict Permissions: Enforce strict limitations on who can create or modify dashboards.
• Harden Configurations: Maintain strict trusted-domain policies and ensure the “dashboard_html_allow_embeddable_content” setting remains disabled to mitigate XSS risks.
• Monitor for Anomalies: While no specific detection signatures are available, continuous monitoring for unusual activity is crucial given the potential impact on sensitive security and operational data.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.