Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication

Splunk released emergency security updates for CVE-2026-20253, a critical (CVSS 9.8) pre-authentication path traversal vulnerability in Splunk Enterprise's search and indexing infrastructure that can allow arbitrary file operations and may lead to remote code execution. The advisory warns of severe impact due to Splunk's central role in security monitoring and recommends immediate patching, restricting management interface exposure, auditing for indicators of compromise, tightening service account permissions, and forwarding audit logs to an isolated destination.