// #splunk

Splunk Enterprise CVE-2026-20253 (CVSS 9.8): No-Authentication RCE Exposes SIEM Servers via PostgreSQL Sidecar

A critical remote code execution vulnerability in Splunk Enterprise allows unauthenticated attackers to run arbitrary commands on SIEM servers by targeting an exposed PostgreSQL sidecar service that bypasses all application-level authentication. CVE-2026-20253, rated CVSS 9.8, affects Splunk Enterprise 9.2.x and earlier on both Windows and Linux — a particularly damaging target given SIEM's visibility across the entire security estate.