{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-20253/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-20253/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-20253/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-20253/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-20253/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-20253"},"sightings":{"href":"/api/v1/sightings/cve-2026-20253"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.96939,"kev":true,"percentile":0.99887},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-20253.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-20253\n\ninfo:\n  name: Splunk Enterprise & Cloud Platform - Unrestricted File Upload\n  author: watchtowrlabs,DhiyaneshDk\n  severity: critical\n  description: |\n    In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.\n  impact: |\n    Unauthenticated attackers can create or truncate arbitrary files, potentially leading to data loss or system compromise.\n  remediation: |\n    Upgrade to Splunk Enterprise 10.2.4, 10.0.7 and Splunk Cloud Platform 10.4.2604.3, 10.2.2510.14 or later.\n  reference:\n    - https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/\n    - https://github.com/watchtowrlabs/watchTowr-vs-Splunk-CVE-2026-20253/blob/main/watchTowr-vs-Splunk-CVE-2026-20253.py\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: body=\"enterprise\" && body=\"splunk\"\n  tags: cve,cve2026,splunk,postgres,backup,vkev,kev\n\nhttp:\n  - raw:\n      - |\n        POST /{{region}}/splunkd/__raw/v1/postgres/recovery/backup HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic ZGFnOg==\n\n    payloads:\n      region:\n        - \"en-US\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Failed to decode\"\n\n      - type: status\n        status:\n          - 400\n# digest: 490a0046304402201da430780814d7865c4b2fcab64e649e06b260eac684ea5f5860ea46bc4dd3030220433b9e7f6979eecf0350f43d916747e20ab31f1620f4875672d5f25a8c6831a1:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-20253"}