CISA Warns of Actively Exploited Splunk Enterprise Critical Function Flaw

CISA added CVE-2026-20253 — a Missing Authentication for Critical Function (CWE-306) in Splunk Enterprise's PostgreSQL sidecar — to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation; the flaw permits unauthenticated remote actors to create or truncate files, risking log corruption, monitoring disruption, and staging for follow-on attacks. Organizations are urged to apply Splunk mitigations, follow BOD 26-04 forensic triage and patching timelines, audit internet-facing sidecar endpoints, and consider discontinuing affected services until patched.