Splunk Enterprise Unauthenticated RCE — CVE-2026-20253

CVE-2026-20253 is a critical (CVSS 9.8) missing-authentication flaw (CWE-306) in Splunk Enterprise. A PostgreSQL sidecar service endpoint bundled with Splunk Enterprise exposes file-create and file-truncate operations without authentication. watchTowr Labs demonstrated that this arbitrary file-write primitive chains into full remote code execution on the Splunk host: the PostgreSQL lo_export large-object export function is abused to write an attacker-controlled script to disk, which is then executed. Because the entry point requires no credentials and is reachable over the network, a single request to an exposed Splunk instance can yield code execution as the Splunk service account.

Affected: Splunk Enterprise 10.0.0–10.0.6 and 10.2.0–10.2.3. Fixed in 10.0.7 / 10.2.4 (or later). watchTowr published a technical write-up and PoC on 2026-06-12; CISA added the CVE to the KEV catalog on 2026-06-18 — the first-ever Splunk vulnerability on KEV — confirming limited in-the-wild exploitation, with an FCEB remediation deadline of 2026-06-21.

Attacker objective: establish unauthenticated code execution on an internet- or intranet-reachable Splunk indexer/search head, then pivot — Splunk hosts are high-value (centralized log data, credentials in config, lateral reach to the rest of the estate).

Highest-value defensive angle: the exploit's terminal step is a Splunk service process spawning a shell or interpreter. splunkd and the bundled postgres sidecar should essentially never parent /bin/sh, bash, python, cmd.exe or powershell.exe. That parent/child anomaly is the cleanest, version-independent detection and the centerpiece of this pack.

Defender priority: Patch to 10.0.7 / 10.2.4+ now (KEV deadline 2026-06-21). Until patched, restrict network access to the Splunk management/sidecar ports and hunt for any Splunk service process spawning a shell/interpreter or writing new executables/scripts under the Splunk install dir.

Decision: No atomic IOCs (attacker IPs, payload hashes, dropped filenames) have been published as of 2026-06-20. This pack ships behavioral signatures only — no fabricated indicators. Concrete IOC fields use REPLACE_WITH_… placeholders to be filled from your own telemetry or a future vendor feed.

Hunt hypotheses

• H1: A Splunk service process (splunkd, bundled postgres sidecar, or a splunk-* helper) spawns a shell or scripting interpreter — the terminal RCE step.
• H2: A new executable or script file is written under the Splunk install directory (/opt/splunk/…, C:\Program Files\Splunk\…) by a Splunk-owned process — the lo_export drop.
• H3: The Splunk host makes anomalous outbound network connections (reverse shell / C2) shortly after a child-process anomaly.
• H4: Splunk internal access logs (splunkd_access.log) show unauthenticated POST traffic to the management/sidecar endpoint from unexpected sources.

Attack chain

No atomic IOCs (IPs / hashes / filenames) published as of 2026-06-20. The table below is behavioral. Replace REPLACE_WITH_… values from your own incident telemetry or a vetted feed before alerting.

Affected: Splunk Enterprise 10.0.0–10.0.6 and 10.2.0–10.2.3 (any role: indexer, search head, heavy forwarder running the bundled PostgreSQL sidecar). Fixed: 10.0.7 / 10.2.4 or later. Default install paths: Linux /opt/splunk (binaries in /opt/splunk/bin); Windows C:\Program Files\Splunk.

Hunts runnable inside Splunk itself and on host OS audit logs — complement the Falcon CQL in §8.

Splunk internal access log (run in Splunk)

index=_internal sourcetype=splunkd_access method=POST
| stats count min(_time) max(_time) values(uri_path) by clientip, status
| where count > 0

Look for POSTs to the management/sidecar endpoint from unexpected client IPs or with no preceding authentication event. Baseline known admin/forwarder IPs first, then alert on the remainder. Confirm whether the PostgreSQL sidecar logs to splunkd_access.log or a separate channel in your build and extend coverage accordingly.

Linux host (auditd / OS)

• Watch for splunkd or postgres (Splunk-owned) as the parent of execve for /bin/sh, bash, python*, perl, curl, wget, nc.
• Watch for new files created under /opt/splunk/ with execute bit set, owned by the Splunk service user, outside upgrade windows.

Windows host (Sysmon)

• Sysmon Event ID 1 — ParentImage under C:\Program Files\Splunk\ spawning cmd.exe / powershell.exe / wscript.exe.
• Sysmon Event ID 11 — file create of .ps1 / .bat / .vbs / .exe under the Splunk install path by a Splunk service process.

// HUNT: Splunk service process spawning a shell/interpreter (CVE-2026-20253 RCE terminal step)
// MITRE: T1059, T1190 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 on Splunk hosts
// FALSE POSITIVES: Splunk scripted inputs, alert-action scripts, custom commands
// TUNING: add ImageFileName exclusions for sanctioned scripted-input wrapper paths
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(splunkd|splunk-optimize|postgres|splunk-.*)$/i
| ImageFileName=/(\/(sh|bash|dash|zsh|ksh|python[0-9.]*|perl|ruby|php)|\\(cmd|powershell|pwsh|wscript|cscript|mshta)\.exe)$/i
| groupBy([ComputerName, ParentBaseFileName, ImageFileName], function=([count(aid, as=hits), collect([CommandLine, UserName])]))
| sort(hits, order=desc)

// HUNT: New executable/script written under Splunk install directory (CVE-2026-20253 payload drop)
// MITRE: T1505.003, T1059 | CONF: high  FP: medium  COST: low | REQUIRES: file-write telemetry on Splunk hosts
// FALSE POSITIVES: Splunk upgrades, app/add-on installs, updater-written binaries
// TUNING: exclude change windows; exclude ContextBaseFileName in (splunkd, msiexec) for sanctioned updates
#event_simpleName=/NewExecutableWritten|PeFileWritten|NewScriptWritten/
| TargetFileName=/(\/opt\/splunk\/|\\Program Files\\Splunk\\)/i
| TargetFileName=/\.(sh|py|pl|rb|php|ps1|bat|cmd|vbs|exe|dll|elf)$/i
| groupBy([ComputerName, ContextBaseFileName, TargetFileName], function=([count(aid, as=writes), collect([UserName])]))
| sort(writes, order=desc)

// HUNT: Outbound network connection from a Splunk host process (CVE-2026-20253 C2 / reverse shell)
// MITRE: T1071, T1059 | CONF: medium  FP: medium  COST: medium | REQUIRES: NetworkConnect telemetry + egress baseline
// FALSE POSITIVES: S2S forwarding (9997), deployment/license traffic, external lookups
// TUNING: maintain an allowlist of RemoteAddressIP4/RemotePort for sanctioned Splunk peers
#event_simpleName=/NetworkConnectIP4|NetworkConnectIP6/
| ContextBaseFileName=/(sh|bash|dash|python[0-9.]*|perl|nc|ncat|socat|powershell|pwsh)/i
| RemotePort!=9997 AND RemotePort!=8089
| RemoteAddressIP4!=/^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/
| groupBy([ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=count(aid, as=conns))
| sort(conns, order=desc)

// HUNT: Reverse-shell / download-cradle command line under a Splunk service process (CVE-2026-20253)
// MITRE: T1059, T1071 | CONF: high  FP: low  COST: medium | REQUIRES: ProcessRollup2 with CommandLine
// FALSE POSITIVES: rare under a Splunk parent; validate scripted inputs that use curl/wget
// TUNING: widen/narrow the CommandLine regex to local tradecraft
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(splunkd|postgres|splunk-.*)$/i
| CommandLine=/(\/dev\/tcp\/|bash\s+-i|nc\s+-e|ncat\s|socat\s|python.{0,40}socket|powershell.{0,40}(IEX|DownloadString|TcpClient)|curl\s.{0,80}\|\s*(sh|bash)|wget\s.{0,80}\|\s*(sh|bash))/i
| groupBy([ComputerName, ParentBaseFileName, ImageFileName, CommandLine], function=count(aid, as=hits))
| sort(hits, order=desc)

// HUNT: Burst of distinct child processes under a Splunk service parent (CVE-2026-20253 post-exploit)
// MITRE: T1059, T1190 | CONF: medium  FP: medium  COST: medium | REQUIRES: ProcessRollup2 on Splunk hosts
// FALSE POSITIVES: hosts with heavy legitimate scripted inputs / alert actions
// TUNING: adjust the distinct_children threshold (default >= 5) to your baseline
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(splunkd|postgres|splunk-.*)$/i
| groupBy([ComputerName, ParentBaseFileName], function=([count(ImageFileName, distinct=true, as=distinct_children), collect([ImageFileName])]))
| distinct_children >= 5
| sort(distinct_children, order=desc)

Field-name note: queries use standard Falcon fields (#event_simpleName, ParentBaseFileName, ImageFileName, CommandLine, TargetFileName, ContextBaseFileName, RemoteAddressIP4, RemotePort, ComputerName, aid). Validate NewScriptWritten availability in your tenant — if absent, Q2 still fires on PE writes via NewExecutableWritten/PeFileWritten plus the file-extension filter.

Deploy IOAs scoped to a Splunk-servers host group so the parent-image constraints stay tight and FP stays low. Start in Detect, promote the high-fidelity reverse-shell IOA to Prevent first.

No atomic IOCs published as of 2026-06-20. CSV rows use REPLACE_WITH_… placeholders — do not import until populated from your own incident data or a vetted feed. The behavioral-signature and audit blocks are ready to use as-is.

type,value,action,severity,expiration,description,tags
ipv4,REPLACE_WITH_C2_IP,detect,high,2026-12-20,Splunk CVE-2026-20253 C2 (fill from incident),campaign:CVE-2026-20253
sha256,REPLACE_WITH_SHA256,prevent,critical,2026-12-20,Splunk CVE-2026-20253 dropped payload,campaign:CVE-2026-20253
domain,REPLACE_WITH_C2_DOMAIN,detect,high,2026-09-20,Splunk CVE-2026-20253 C2 domain,campaign:CVE-2026-20253

BEHAVIOR: Splunk service proc (splunkd|postgres|splunk-*) parents shell/interpreter   -> detect (Q1,Q4)
BEHAVIOR: New .sh|.py|.ps1|.exe written under /opt/splunk or C:\Program Files\Splunk  -> detect (Q2)
BEHAVIOR: Outbound conn from Splunk host shell/interpreter to non-baseline dest       -> hunt   (Q3)
BEHAVIOR: Reverse-shell cmdline (/dev/tcp, nc -e, IEX+TcpClient) under Splunk parent   -> prevent (Q4)
BEHAVIOR: Unauth POST to Splunk mgmt/sidecar endpoint from unexpected client IP        -> hunt   (Q5,sect 7)

SPL  index=_internal sourcetype=splunkd_access method=POST | stats count by clientip,uri_path,status
LIN  ausearch -m EXECVE | grep -E "ppid.*(splunkd|postgres)" | grep -E "/bin/sh|bash|python"
LIN  find /opt/splunk -newer /opt/splunk/etc/splunk.version -type f -perm -u+x 2>/dev/null
WIN  Sysmon EID 1 ParentImage="C:\Program Files\Splunk\*" Image="*\\(cmd|powershell|wscript).exe"
WIN  Sysmon EID 11 TargetFilename="C:\Program Files\Splunk\*" + ext in (.ps1,.bat,.vbs,.exe)

FIXED: Splunk Enterprise 10.0.7+ (from 10.0.0-10.0.6) | 10.2.4+ (from 10.2.0-10.2.3)
AUDIT: /opt/splunk/bin/splunk version    (Linux)
AUDIT: "C:\Program Files\Splunk\bin\splunk.exe" version    (Windows)
EXPOSE: restrict mgmt 8089 + PostgreSQL sidecar port to admin subnets only (firewall/segmentation)
KEV: CISA added 2026-06-18, FCEB remediation deadline 2026-06-21

1 · Confirm version on every Splunk host

# Linux
/opt/splunk/bin/splunk version
# Windows (PowerShell)
& "C:\Program Files\Splunk\bin\splunk.exe" version
# Flag any host reporting 10.0.0-10.0.6 or 10.2.0-10.2.3 as VULNERABLE

2 · Restrict mgmt + sidecar exposure (interim, until patched)

# Linux host firewall example (allow only admin subnet to 8089)
iptables -A INPUT -p tcp --dport 8089 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8089 -j DROP
# Confirm the PostgreSQL sidecar port (per your build) is NOT exposed beyond localhost/admin subnet
ss -ltnp | grep -E "postgres|splunkd"

3 · Sweep install dir for recently-written executables/scripts

# Linux: files under Splunk dir newer than the version marker, with exec bit
find /opt/splunk -type f -perm -u+x -newer /opt/splunk/etc/splunk.version 2>/dev/null
# Windows (PowerShell): scripts/exe written in the last 14 days under the install path
Get-ChildItem "C:\Program Files\Splunk" -Recurse -Include *.ps1,*.bat,*.vbs,*.exe -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) }

Treat any unexpected hit as potential compromise: isolate the host, preserve /opt/splunk (or the Windows install dir) and host process/network logs, and run the §14 containment runbook.

Coverage gap: the initial unauthenticated HTTP request to the PostgreSQL sidecar endpoint is not directly visible in standard Falcon process telemetry — it surfaces in Splunk's own access logs (§7) and at the network/NDR layer. Pair this pack with Splunk _internal log monitoring and firewall/NDR visibility on the sidecar port to close it.

Validation: all five CQL queries depend on Falcon sensor coverage of Splunk hosts. Confirm telemetry per §11 before promoting any query to alert, and baseline scripted-input / upgrade activity to keep FP low.