CISA Issues Alert on Critical Splunk Enterprise Bug Under Active Exploitation

CISA has issued an urgent alert for CVE-2026-20253, a critical Splunk Enterprise vulnerability in the PostgreSQL sidecar that allows unauthenticated arbitrary file creation or truncation; the flaw was added to CISA's KEV catalog with a BOD 26-04 remediation deadline (June 21, 2026). Organizations are advised to apply vendor patches immediately, restrict access or segment vulnerable services when patching is not possible, and monitor for indicators such as unauthorized file changes, anomalous sidecar activity, and log tampering.