Suspicious PostgreSQL Utility Execution via Splunk (CVE-2026-20253)

Tim P@timdetections

•updated Jun 16, 2026•2•0•24

Detects the execution of pg_dump or pg_restore initiated by Splunk processes with unexpected remote hosts or custom directories. This behavior is indicative of CVE-2026-20253 exploitation, where an unauthenticated attacker can abuse the PostgreSQL Sidecar Service to achieve remote code execution.