Splunk has released security updates to address a critical vulnerability in Splunk Enterprise that could allow unauthenticated attackers to perform arbitrary file operations and achieve remote code execution (RCE) on vulnerable systems. The flaw, tracked as CVE-2026-20253, stems from missing authentication controls on a PostgreSQL sidecar service, enabling any network-accessible user to interact with, backup, and restore recovery endpoints without credentials. Security researchers demonstrated that attackers can exploit these endpoints to import malicious PostgreSQL database dumps, leverage a local .pgpass file to authenticate to Splunk’s internal database, and execute attacker-controlled SQL during the restore process. By abusing PostgreSQL’s lo_export function, adversaries can write arbitrary files to the Splunk file system and overwrite Python scripts that Splunk executes regularly, resulting in pre-authenticated RCE. The vulnerability affects Splunk Enterprise versions 10.0.0–10.0.6 and 10.2.0–10.2.3, with fixes available in versions 10.0.7 and 10.2.4, while Splunk Enterprise 10.4 and Splunk Cloud are not affected. In addition to CVE-2026-20253, Splunk patched multiple other vulnerabilities, including high-severity flaws that could enable RCE, server-side request forgery (SSRF), and cross-site scripting (XSS), as well as medium-severity issues in Splunk Enterprise and Splunk SOAR that could allow sensitive data exfiltration, saved search ownership reassignment, or log injection attacks. Separately, Palo Alto Networks addressed several vulnerabilities across its portfolio, including the high-severity CVE-2026-0274 affecting Cortex XSOAR and Cortex XSIAM, which could allow attackers to access and modify restricted resources due to improper credential validation in the CommvaultSecurityIQ integration. Although neither vendor has reported active exploitation of these vulnerabilities, the public release of technical details for CVE-2026-20253 significantly raises the risk of opportunistic attacks, making prompt patching and exposure assessments a priority for affected organizations.