Splunk Enterprise RCE Flaw Under Active Exploitation, CISA Gives Feds 72 Hours

Patch windows used to be measured in weeks. Now you're counting days before someone weaponizes a disclosure.

CVE-2026-20253 is an unauthenticated remote code execution vulnerability in Splunk Enterprise. No credentials required. That's the part that matters operationally. An attacker who can reach your Splunk instance over the network can run arbitrary code before they've proved they're anyone at all.

CISA added the flaw to its Known Exploited Vulnerabilities catalog and handed federal civilian executive branch agencies a three-day remediation deadline. Seventy-two hours. For context, that's the kind of window you get when exploitation is already observed in the wild, not theoretical.

The failure mode here is familiar. Splunk Enterprise often sits inside corporate networks with broad inbound access — it ingests logs from everywhere, so naturally it talks to everything. Security teams treat it as infrastructure rather than an attack surface. In practice, that means it frequently doesn't get the same patch urgency as an internet-facing load balancer, even though it holds some of the most sensitive data in the environment: authentication logs, CloudTrail events pulled from S3, VPC flow logs, whatever your SIEM pipeline is feeding it.

If you're running Splunk in AWS, think about what's adjacent. An EC2 instance hosting Splunk with an overly permissive IAM role attached is a lateral movement gift. Compromise the process, inherit the role, start calling sts:AssumeRole or pulling from S3 buckets. The RCE is the entry point; the blast radius depends on how your IAM posture looks on a Tuesday afternoon when nobody's thinking about it.

Splunk's security advisory has the affected versions and the fixed builds. Go read it. Apply the patch. If you can't patch immediately, review your network segmentation — Splunk should not be reachable from arbitrary internal subnets, and it should never be internet-exposed directly.

One thing the post-mortem will say: the patch was available, the exploit was public, and the ticket sat in the backlog.

Check your Splunk version before you check anything else today.