Splunk Urges Immediate Patching of Critical Flaw Enabling Arbitrary File Operations

A critical vulnerability (CVE-2026-20253, CVSS 9.8) in Splunk Enterprise's PostgreSQL sidecar allows unauthenticated attackers to create or truncate arbitrary files via endpoints and PostgreSQL functions (notably lo_export), enabling escalation from arbitrary file write to remote code execution by replacing routinely executed Python scripts; affected on-prem versions are below 10.2.4 and 10.0.7 and Splunk has released fixes while Splunk Cloud is unaffected.