Unauthenticated request to Splunk management REST API (CVE-2026-20253)

Ankit Mehta@Secvyn

•updated 8 days ago•0•0•2

This rule detects potential exploitation attempts targeting the Splunk REST API (CVE-2026-20253) by monitoring for unauthenticated inbound requests to the /services/ path. It specifically looks for requests that lack the required Authorization or Cookie headers.