Splunk Enterprise Unauthenticated Arbitrary File Operations/RCE (CVE-2026-20253): Overview and Takeaways

CVE-2026-9082 (CVSS 9.8) lets unauthenticated attackers run arbitrary SQL against Drupal Core on PostgreSQL via crafted JSON:API queries, risking database compromise or RCE; upgrade immediately.

CVE-2026-41940 (CVSS 9.8) is an authentication bypass in cPanel & WHM and WP Squared that injects values into server-side session files for root-level access, and was exploited before the patch.

While remote code execution depends on runtime prerequisites like PEAR, the unauthenticated LFI primitive resides directly in WordPress Core and affects all major branches from 4.7.0 through 7.1.1.

When self-registration is enabled, any unauthenticated attacker can create an account and immediately achieve host-level remote code execution on self-hosted Gitea instances.

Affects all WordPress installations from version 4.7.0 through 7.1.0 without requiring credentials or interaction beyond opening a post. Administrators should verify upgrading to 7.1.1 or backported releases, and monitor server logs for suspicious comment payloads and unexpected plugin uploads.

Dynamic Open Graph image generation is common in Next.js apps; any route accepting user parameters to customize SVG cards could lead to full Node.js server compromise.