attacker-db[.]comDomain
Reported by 1 independent source · first reported by Zscaler ThreatLabz · last reported
Last reported 3 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Critical Unauthenticated Remote Code Execution in Splunk Enterprise (CVE-2026-20253)“By injecting connection string parameters (for example, hostaddr=attacker-db[.]com), the attacker can override the intended host and cause Splunk to fetch a database from the attacker’s server and write it to the specified backupFile.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-20253
Thanks — we review every report.