The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Splunk Enterprise vulnerability, CVE-2026-20253, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The flaw, rated 9.8 (Critical), allows unauthenticated attackers to create or modify files on vulnerable systems and could lead to remote code execution and full system compromise. Affected organizations are urged to apply security updates immediately, with federal agencies required to remediate the issue by the specified CISA deadline.