CVE-2026-20253 Splunk REST API Malicious Search Command RCE via splunkd Child Process

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects instances where the 'splunkd' process acts as a parent to common command-line interpreters (e.g., bash, powershell, python) or network utilities (e.g., curl, wget, netcat, nmap). This behavior is highly suspicious as the Splunk daemon should not typically invoke shells or network tools, and may indicate exploitation of the Splunk environment, lateral movement, or unauthorized task execution.