Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure

A critical unauthenticated RCE in Splunk Enterprise (CVE-2026-20253) is being actively exploited following public disclosure and patch release; CISA added the CVE to its Known Exploited Vulnerabilities catalog with an unusually short three-day remediation mandate. The flaw allows remote arbitrary code execution via specially crafted search job requests, risking exposure and tampering of indexed security logs, lateral movement, and compromised incident response; the report describes exploitation timeline, impact, CISA guidance, and immediate remediation steps (apply patches, restrict network access, audit logs and accounts).