Splunk zero-day: unauthenticated file writes via PostgreSQL sidecar, already exploited
CVE-2026-20253 is being exploited in the wild against Splunk Enterprise with no login required. Also: a CVSS 9.1 OpenSSL signature forgery, two Office RCE bugs at 8.4, and a Linux kernel io_uring privesc.
Heads up: attackers are hitting an unauthenticated file-write bug in Splunk Enterprise right now (CVE-2026-20253). No login, no user interaction, just a request to a PostgreSQL sidecar endpoint. That one needs your attention first. Behind it, a CVSS 9.1 OpenSSL forgery bug and two Office RCEs round out a busy five-patch day.
Today's CVEs
Sorted by urgencyCVE-2026-20253
CISA KEVAn unauthenticated attacker can hit a PostgreSQL sidecar endpoint in Splunk Enterprise to create or truncate arbitrary files on the host. No login required, no user interaction needed. This is already exploited in the wild, and the EPSS score (0.10, 95th percentile) confirms attackers are actively going after it.
- Affected estate
- Anyone running on-prem Splunk Enterprise with the PostgreSQL sidecar service exposed
- How to check
- Run 'splunk version' on your search heads and indexers. Check whether the PostgreSQL sidecar service port is listening and reachable from outside localhost.
- Included because
- unauthenticated; no user interaction; exploited in the wild; high EPSS percentile; common product
- Action
- Patch to the fixed Splunk Enterprise version immediately. Restrict network access to the PostgreSQL sidecar endpoint as a short-term mitigation.
- Why it matters
- Unauthenticated file creation or truncation can lead to data loss, config tampering, or full system compromise, and attackers are already using this.
Evidence trail
- NVD: View source
CVE-2026-34182
MSRCA flaw in CMS AuthEnvelopedData processing lets an attacker forge authenticated messages that OpenSSL (and consumers like Node.js, QEMU, EDK2) will accept as valid. CVSS 9.1. This could let someone tamper with signed or encrypted payloads without detection. No known exploitation in the wild yet.
- Affected estate
- Azure Linux 3.0 operators running OpenSSL 3.3.5-5, Node.js 24.14.1-3, QEMU 9.1.0-7, EDK2 20240524, or cloud-hypervisor 51.1.56-1
- How to check
- Run 'rpm -q openssl nodejs qemu edk2 cloud-hypervisor' on your Azure Linux 3.0 hosts and compare against the affected versions listed above.
- Included because
- CVSS 9.1; affects cryptographic trust; multiple widely deployed components
- Action
- Run 'tdnf update' to pull fixed packages for all affected components.
- Why it matters
- Forged CMS messages can bypass authentication on encrypted communications, undermining trust in signed payloads across multiple services.
- Source
- NVD
Evidence trail
- NVD: View source
CVE-2026-45474
MSRCA heap buffer overflow in Microsoft Office lets an attacker run code on the local machine. Exploitation requires a user to open a malicious file, so this is a social engineering play: a crafted document in email or a download link. CVSS 8.4, not yet exploited in the wild.
- Affected estate
- Anyone running Microsoft 365 Apps for Enterprise (32-bit or 64-bit), Office 2016, or Office 2019 (32-bit) on Windows
- How to check
- Open any Office app, go to File > Account > About, and check the build number against the fixed version in the Microsoft advisory.
- Included because
- CVSS 8.4; code execution; extremely common product; user interaction required lowers immediacy
- Action
- Push the latest Office security update through your patch management tool this week.
- Why it matters
- A user opening a weaponized document could give an attacker code execution on the workstation, which is one pivot away from lateral movement.
- Source
- NVD
Evidence trail
- NVD: View source
CVE-2026-45458
MSRCA type confusion bug in Microsoft Office lets an attacker execute code locally. Like the other Office bug this cycle, it needs a user to open a malicious file. CVSS 8.4, no exploitation in the wild yet. This one also hits Office for Mac.
- Affected estate
- Anyone running Microsoft 365 Apps for Enterprise, Office 2019 (32-bit or 64-bit), or Office 365 for Mac
- How to check
- On Windows: File > Account > About in any Office app. On Mac: open any Office app, click the app menu > About, and compare the version against the advisory.
- Included because
- CVSS 8.4; code execution; very common product; cross-platform (Windows and macOS); user interaction required
- Action
- Deploy the latest Office security update on both Windows and macOS endpoints this week.
- Why it matters
- Type confusion bugs are reliable exploitation targets, and Office documents are the most common phishing payload. One click gets code execution.
- Source
- NVD
Evidence trail
- NVD: View source
CVE-2026-46274
MSRCA local privilege escalation bug in the Linux kernel's io-wq subsystem (used by io_uring). An attacker with local access could exploit a missing hash check in io_wq_remove_pending() to escalate privileges. CVSS 7.8, but it requires local access and the EPSS score is very low (0.001, 3rd percentile).
- Affected estate
- Azure Linux 3.0 operators running kernel 6.6.139.1-1
- How to check
- Run 'uname -r' and check for version 6.6.139.1-1.
- Included because
- CVSS 7.8; local privilege escalation; requires local access; low EPSS; limited to specific Azure Linux kernel version
- Action
- Schedule a kernel update to the fixed version in your next maintenance window.
- Why it matters
- Local privilege escalation in the kernel can turn any compromised service account into root, but the local access requirement and low EPSS give you time to schedule this properly.
- Source
- NVD
Evidence trail
- NVD: View source
One email, every Wednesday morning.
SubscribeFrom the field notes
From this beat
Read the rest of the field notes →