Splunk Enterprise RCE flaw hit by attacks, agencies forced to patch in three days
Splunk Enterprise versions 10.2 below 10.2.4 and 10.0 below 10.0.7 allow unauthenticated attackers to create or truncate arbitrary files via a PostgreSQL sidecar endpoint, enabling remote code execution. Splunk confirmed limited exploitation within days of disclosure, prompting CISA to give federal agencies just three days to patch.