CVE-2026-20253: Critical Splunk Enterprise Unauthenticated RCE — Detection and Patching Guide

---
title: Potential Splunk CVE-2026-20253 Exploitation - Shell Spawn
id: 8a4b2c10-9d3e-4f56-a890-123456789abc
status: experimental
description: Detects potential exploitation of CVE-2026-20253 by identifying the Splunk process spawning unexpected shells (bash, sh, zsh) or scripting languages (python, perl). This indicates successful RCE.
references:
  - https://advisory.splunk.com/advisories/SVD-2026-0601
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.execution
  - attack.t1059.004
  - cve-2026-20253
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/splunkd'
      - '/bin/splunkd'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection
falsepositives:
  - Legitimate Splunk scripted inputs or alert actions (rare for base shells)
level: critical
---
title: Potential Splunk CVE-2026-20253 Exploitation - Windows Shell Spawn
id: 9c5d3e21-0e4f-5a67-b901-234567890bcd
status: experimental
description: Detects potential exploitation of CVE-2026-20253 on Windows by identifying splunkd.exe spawning cmd.exe or powershell.exe.
references:
  - https://advisory.splunk.com/advisories/SVD-2026-0601
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - cve-2026-20253
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\splunkd.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate scripted inputs configured by administrators
level: critical

// Hunt for Splunk spawning suspicious processes (Linux via Syslog/CEF)
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName has "splunkd"
| where ProcessFileName in ("bash", "sh", "zsh", "python", "python3", "perl", "ruby")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName
| extend FileType = "Linux-Splunk-Exploit"

// Hunt for Splunk spawning suspicious processes (Windows)
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName =~ "splunkd.exe"
| where ProcessFileName in ("cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName
| extend FileType = "Windows-Splunk-Exploit"

-- Hunt for Splunk process parents spawning shells or interpreters
SELECT Pid, PPid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE PPid IN (
    SELECT Pid
    FROM pslist()
    WHERE Name =~ "splunkd" OR Exe =~ "splunkd"
)
AND Name IN ("bash", "sh", "zsh", "python", "python3", "perl", "cmd.exe", "powershell.exe")

-- Check for recently created files in Splunk directories (potential webshells)
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="/opt/splunk/**/*.py", root="/")
WHERE Mtime > now() - 24h
  AND NOT FullPath =~ "(bin/scripts|etc/apps|var/log/splunk)"

#!/bin/bash

# Script to check Splunk Version for CVE-2026-20253 (CVE-2026-20253)
# Affected: < 10.2.4 and < 10.0.7

SPLUNK_HOME=${SPLUNK_HOME:-/opt/splunk}
SPLUNK_BIN="$SPLUNK_HOME/bin/splunk"

if [ ! -f "$SPLUNK_BIN" ]; then
    echo "Splunk binary not found at $SPLUNK_BIN. Please set SPLUNK_HOME env var."
    exit 1
fi

echo "Checking Splunk version for CVE-2026-20253 vulnerability..."

# Get version string
VERSION=$($SPLUNK_BIN version | head -n 1)
# Extract just the version number (e.g., 9.1.2 or 10.2.3)
VERSION_NUM=$(echo "$VERSION" | grep -oP '\d+\.\d+\.\d+')

echo "Detected Version: $VERSION_NUM"

# Function to compare versions
check_version() {
    if [[ "$1" == "$2" ]]; then
        return 0
    fi
    local IFS=.
    local i ver1=($1) ver2=($2)
    for ((i=${#ver1[@]}; i<${#ver2[@]}; i++)); do
        ver1[i]=0
    done
    for ((i=0; i<${#ver1[@]}; i++)); do
        if [[ -z ${ver2[i]} ]]; then
            ver2[i]=0
        fi
        if ((10#${ver1[i]} > 10#${ver2[i]})); then
            return 1
        fi
        if ((10#${ver1[i]} < 10#${ver2[i]})); then
            return 2
        fi
    done
    return 0
}

VULNERABLE=false

# Check against fixed versions 10.2.4 and 10.0.7
# Logic: If version is < 10.2.4 OR (< 10.1.0 AND < 10.0.7)
# Simplified: Check major branches.

MAJOR=$(echo "$VERSION_NUM" | cut -d. -f1)
MINOR=$(echo "$VERSION_NUM" | cut -d. -f2)
PATCH=$(echo "$VERSION_NUM" | cut -d. -f3)

if [ "$MAJOR" -lt 10 ]; then
    VULNERABLE=true
elif [ "$MAJOR" -eq 10 ]; then
    if [ "$MINOR" -eq 0 ]; then
        if [ "$PATCH" -lt 7 ]; then
            VULNERABLE=true
        fi
    elif [ "$MINOR" -eq 2 ]; then
        if [ "$PATCH" -lt 4 ]; then
            VULNERABLE=true
        fi
    elif [ "$MINOR" -eq 1 ]; then
        # Assuming 10.1.x is unsupported or affected based on "below 10.2.4 and 10.0.7" logic usually covering all in between
        VULNERABLE=true
    fi
fi

if [ "$VULNERABLE" = true ]; then
    echo "[ALERT] This installation is VULNERABLE to CVE-2026-20253."
    echo "Action Required: Update to Splunk Enterprise 10.2.4 or 10.0.7 immediately."
    exit 2
else
    echo "[OK] This installation appears to be patched."
    exit 0
fi