Detections
Analytics

Splunk Enterprise < 10.0.7 / 10.2.x < 10.2.4 Remote Code Execution

critical Web App Scanning Plugin ID 115266

Synopsis

Splunk Enterprise < 10.0.7 / 10.2.x < 10.2.4 Remote Code Execution

Description

The detected Splunk Enterprise instance exposes an unauthenticated PostgreSQL sidecar service endpoint reachable through the splunkd __raw proxy. The endpoint lacks authentication controls, allowing any network-reachable, unauthenticated user to invoke file operations, which can be leveraged to achieve remote code execution. The scanner confirmed the vulnerability by interacting with the unprotected backend endpoint.

Solution

Upgrade to Splunk Enterprise 10.0.7, 10.2.4, or later. As a mitigation, disable the PostgreSQL sidecar service. Refer to Splunk advisory SVD-2026-0603 for details.

See Also

https://advisory.splunk.com/advisories/SVD-2026-0603

Plugin Details

Severity: Critical

ID: 115266

Type: Check Based

Published: 6/17/2026

Updated: 6/17/2026

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-20253

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2026-20253

Vulnerability Information

CPE: cpe:2.3:a:splunk:splunk:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/10/2026

Vulnerability Publication Date: 6/9/2026

Reference Information

CVE: CVE-2026-20253