Tag

#siem

1 post tagged #siem.

Analysis · Jun 20, 2026 · Colten Anderson

Splunk Enterprise 10 shipped an unauthenticated database endpoint on port 8000

CVE-2026-20253 (CVSS 9.8) exposes a PostgreSQL sidecar service introduced in Splunk Enterprise 10 with no HTTP-layer authentication, reachable through the same port as the login page. A published exploit chain reaches code execution in minutes. Exploitation is confirmed. The 'disable the sidecar' workaround breaks SPL2 and Edge Processor.