Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication

Splunk Enterprise CVE-2026-20253 (CVSS 9.8) is a critical unauthenticated vulnerability in the PostgreSQL sidecar service that allows attackers to create/write arbitrary files and potentially achieve pre-authenticated remote code execution via the /v1/postgres/recovery/backup and /restore endpoints; fixes are available in Splunk Enterprise 10.0.7 and 10.2.4 (Splunk Cloud not affected), and technical exploit details have been published though no active exploitation has been observed.