What is the Attack? A critical authentication bypass vulnerability, CVE-2026-20253 (CVSS 9.8), affects Splunk Enterprise versions 10.0.x and 10.2.x. The flaw stems from missing authentication on a PostgreSQL sidecar service endpoint, allowing an unauthenticated attacker to create or truncate arbitrary files on a vulnerable server. Security researchers have demonstrated that the vulnerability can be leveraged toward pre-authentication remote code execution (RCE) under certain conditions, and active exploitation has been confirmed. The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog, making it a high-priority patching target for organizations running exposed Splunk Enterprise instances. An attacker who successfully exploits CVE-2026-20253 may be able to: • Create or truncate arbitrary files on the target server. • Bypass authentication protections. • Potentially achieve pre-authentication remote code execution. • Disrupt Splunk services. What is the recommended Mitigation? Affected: Splunk Enterprise 10.2 prior to 10.2.4 Splunk Enterprise 10.0 prior to 10.0.7 Upgrade to: Splunk Enterprise 10.2.4 or later Splunk Enterprise 10.0.7 or later If immediate patching is not possible: • Disable the PostgreSQL sidecar service as recommended by Splunk. • Restrict network access to Splunk management interfaces. • Monitor for unexpected file creation or service behavior. • Review logs for suspicious unauthenticated access attempts. What FortiGuard Coverage is available? • FortiGuard IPS provides protection against exploit attempts targeting vulnerable services. • FortiGuard Web Filtering blocks access to known malicious infrastructure used during exploitation. • FortiGuard AntiVirus detects and blocks malware payloads delivered following successful exploitation. • FortiEDR detects suspicious post-exploitation behavior, including unauthorized file modifications and persistence techniques. • FortiGuard Incident Response Service assists organizations in investigating and determining the scope of compromise, and supporting remediation efforts following exploitation.