{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-20253/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-20253/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-20253/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-20253/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-20253/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-20253"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-20253"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.96939,
      "kev": true,
      "percentile": 0.99887
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-20253.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2026-20253\n\ninfo:\n  name: Splunk Enterprise & Cloud Platform - Unrestricted File Upload\n  author: watchtowrlabs,DhiyaneshDk\n  severity: critical\n  description: |\n    In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.<br><br>The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.\n  impact: |\n    Unauthenticated attackers can create or truncate arbitrary files, potentially leading to data loss or system compromise.\n  remediation: |\n    Upgrade to Splunk Enterprise 10.2.4, 10.0.7 and Splunk Cloud Platform 10.4.2604.3, 10.2.2510.14 or later.\n  reference:\n    - https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/\n    - https://github.com/watchtowrlabs/watchTowr-vs-Splunk-CVE-2026-20253/blob/main/watchTowr-vs-Splunk-CVE-2026-20253.py\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: body=\"enterprise\" && body=\"splunk\"\n  tags: cve,cve2026,splunk,postgres,backup,vkev,kev\n\nhttp:\n  - raw:\n      - |\n        POST /{{region}}/splunkd/__raw/v1/postgres/recovery/backup HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Basic ZGFnOg==\n\n    payloads:\n      region:\n        - \"en-US\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Failed to decode\"\n\n      - type: status\n        status:\n          - 400\n# digest: 490a0046304402201da430780814d7865c4b2fcab64e649e06b260eac684ea5f5860ea46bc4dd3030220433b9e7f6979eecf0350f43d916747e20ab31f1620f4875672d5f25a8c6831a1:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-20253"
}