Vulnerability-Lookup

CVE-2026-20251 (GCVE-0-2026-20251)

Vulnerability from cvelistv5 – Published: 2026-06-10 17:16 – Updated: 2026-06-11 03:55

Title

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

Summary

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-10 00:00 UTC

CWE

CWE-502 - The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Assigner

cisco CNA under the mitre root

CNA scorecard C 66/100 over 443 records in the last 180 days details

References

1 reference

URL	Tags
https://advisory.splunk.com/advisories/SVD-2026-0601

Impacted products

3 products

Vendor	Product	Version	CPE status
Splunk	Splunk Enterprise	Affected: 10.2 , < 10.2.4 (custom) Affected: 10.0 , < 10.0.7 (custom) Affected: 9.4 , < 9.4.12 (custom) Affected: 9.3 , < 9.3.13 (custom)	guessed
Splunk	Splunk Cloud Platform	Affected: 10.3.2512 , < 10.3.2512.12 (custom) Affected: 10.2.2510 , < 10.2.2510.14 (custom) Affected: 10.1.2507 , < 10.1.2507.22 (custom) Affected: 9.3.2411 , < 9.3.2411.132 (custom)	guessed
Splunk	Splunk Secure Gateway	Affected: 3.10 , < 3.10.6 (custom) Affected: 3.9 , < 3.9.20 (custom) Affected: 3.8 , < 3.8.67 (custom)	guessed

Date Public

2026-06-10 00:00

Credits

M Mahdan Argya Syarif (0xbeludan)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20251",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T03:55:39.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "10.2.4",
              "status": "affected",
              "version": "10.2",
              "versionType": "custom"
            },
            {
              "lessThan": "10.0.7",
              "status": "affected",
              "version": "10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "9.4.12",
              "status": "affected",
              "version": "9.4",
              "versionType": "custom"
            },
            {
              "lessThan": "9.3.13",
              "status": "affected",
              "version": "9.3",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "10.3.2512.12",
              "status": "affected",
              "version": "10.3.2512",
              "versionType": "custom"
            },
            {
              "lessThan": "10.2.2510.14",
              "status": "affected",
              "version": "10.2.2510",
              "versionType": "custom"
            },
            {
              "lessThan": "10.1.2507.22",
              "status": "affected",
              "version": "10.1.2507",
              "versionType": "custom"
            },
            {
              "lessThan": "9.3.2411.132",
              "status": "affected",
              "version": "9.3.2411",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Secure Gateway",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "3.10.6",
              "status": "affected",
              "version": "3.10",
              "versionType": "custom"
            },
            {
              "lessThan": "3.9.20",
              "status": "affected",
              "version": "3.9",
              "versionType": "custom"
            },
            {
              "lessThan": "3.8.67",
              "status": "affected",
              "version": "3.8",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "M Mahdan Argya Syarif (0xbeludan)"
        }
      ],
      "datePublic": "2026-06-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.\u003cbr\u003e\u003cbr\u003eThe Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the \u2018jsonpickle\u2019 Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation."
            }
          ],
          "value": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.\u003cbr\u003e\u003cbr\u003eThe Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the \u2018jsonpickle\u2019 Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T17:16:00.352Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2026-0601"
        }
      ],
      "source": {
        "advisory": "SVD-2026-0601"
      },
      "title": "Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20251",
    "datePublished": "2026-06-10T17:16:00.352Z",
    "dateReserved": "2025-10-08T11:59:15.401Z",
    "dateUpdated": "2026-06-11T03:55:39.372Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-20251",
      "date": "2026-10-29",
      "epss": "0.32215",
      "percentile": "0.98317"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Splunk Enterprise",
                "vendor": "Splunk",
                "versions": [
                  {
                    "lessThan": "10.2.4",
                    "status": "affected",
                    "version": "10.2",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "10.0.7",
                    "status": "affected",
                    "version": "10.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "9.4.12",
                    "status": "affected",
                    "version": "9.4",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "9.3.13",
                    "status": "affected",
                    "version": "9.3",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "Splunk Cloud Platform",
                "vendor": "Splunk",
                "versions": [
                  {
                    "lessThan": "10.3.2512.12",
                    "status": "affected",
                    "version": "10.3.2512",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "10.2.2510.14",
                    "status": "affected",
                    "version": "10.2.2510",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "10.1.2507.22",
                    "status": "affected",
                    "version": "10.1.2507",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "9.3.2411.132",
                    "status": "affected",
                    "version": "9.3.2411",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "product": "Splunk Secure Gateway",
                "vendor": "Splunk",
                "versions": [
                  {
                    "lessThan": "3.10.6",
                    "status": "affected",
                    "version": "3.10",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "3.9.20",
                    "status": "affected",
                    "version": "3.9",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "3.8.67",
                    "status": "affected",
                    "version": "3.8",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "psirt@cisco.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "B9D80F1C-F849-4D62-B82A-6B8963EEEBFB",
                    "versionEndExcluding": "9.3.13",
                    "versionStartIncluding": "9.3.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "423B8DF2-B7A5-41AA-9CFD-75B2FD503ACC",
                    "versionEndExcluding": "9.4.12",
                    "versionStartIncluding": "9.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "0C9F1DED-280E-4C76-A867-A7A8FCBD1F7A",
                    "versionEndExcluding": "10.0.7",
                    "versionStartIncluding": "10.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "E3B992C0-AD5E-43A1-BAA3-6B11FFD5D750",
                    "versionEndExcluding": "10.2.4",
                    "versionStartIncluding": "10.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "88A68C7C-BE2C-465C-812B-8F211A8AE935",
                    "versionEndExcluding": "9.3.2411.132",
                    "versionStartIncluding": "9.3.2411",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "13BDF451-89BD-4E5B-8DCB-16BF9AE81FAC",
                    "versionEndExcluding": "10.1.2507.22",
                    "versionStartIncluding": "10.1.2507",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BE580133-150E-4007-989F-00491BF7A064",
                    "versionEndExcluding": "10.2.2510.14",
                    "versionStartIncluding": "10.2.2510",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D78DAE10-4B29-4B44-B09A-041500E22CEF",
                    "versionEndExcluding": "10.3.2512.12",
                    "versionStartIncluding": "10.3.2512",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B9361838-B66C-4485-898F-6A3FFD401DEA",
                    "versionEndExcluding": "3.8.67",
                    "versionStartIncluding": "3.8.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2A2F72B2-2F09-4EA8-8AFB-D35FC5652117",
                    "versionEndExcluding": "3.9.20",
                    "versionStartIncluding": "3.9.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "25DD95BD-64E4-4DCC-BBD3-05CD8D168D50",
                    "versionEndExcluding": "3.10.6",
                    "versionStartIncluding": "3.10.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.\u003cbr\u003e\u003cbr\u003eThe Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the \u2018jsonpickle\u2019 Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation."
          }
        ],
        "id": "CVE-2026-20251",
        "lastModified": "2026-06-17T10:17:19.723",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "psirt@cisco.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-20251",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-10T18:16:40.477",
        "references": [
          {
            "source": "psirt@cisco.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://advisory.splunk.com/advisories/SVD-2026-0601"
          }
        ],
        "sourceIdentifier": "psirt@cisco.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-502"
              }
            ],
            "source": "psirt@cisco.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-20251",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-10T18:26:04.875815Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-10T18:26:08.626Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Splunk Enterprise",
              "vendor": "Splunk",
              "versions": [
                {
                  "lessThan": "10.2.4",
                  "status": "affected",
                  "version": "10.2",
                  "versionType": "custom"
                },
                {
                  "lessThan": "10.0.7",
                  "status": "affected",
                  "version": "10.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "9.4.12",
                  "status": "affected",
                  "version": "9.4",
                  "versionType": "custom"
                },
                {
                  "lessThan": "9.3.13",
                  "status": "affected",
                  "version": "9.3",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "Splunk Cloud Platform",
              "vendor": "Splunk",
              "versions": [
                {
                  "lessThan": "10.3.2512.12",
                  "status": "affected",
                  "version": "10.3.2512",
                  "versionType": "custom"
                },
                {
                  "lessThan": "10.2.2510.14",
                  "status": "affected",
                  "version": "10.2.2510",
                  "versionType": "custom"
                },
                {
                  "lessThan": "10.1.2507.22",
                  "status": "affected",
                  "version": "10.1.2507",
                  "versionType": "custom"
                },
                {
                  "lessThan": "9.3.2411.132",
                  "status": "affected",
                  "version": "9.3.2411",
                  "versionType": "custom"
                }
              ]
            },
            {
              "product": "Splunk Secure Gateway",
              "vendor": "Splunk",
              "versions": [
                {
                  "lessThan": "3.10.6",
                  "status": "affected",
                  "version": "3.10",
                  "versionType": "custom"
                },
                {
                  "lessThan": "3.9.20",
                  "status": "affected",
                  "version": "3.9",
                  "versionType": "custom"
                },
                {
                  "lessThan": "3.8.67",
                  "status": "affected",
                  "version": "3.8",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "M Mahdan Argya Syarif (0xbeludan)"
            }
          ],
          "datePublic": "2026-06-10T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.\u003cbr\u003e\u003cbr\u003eThe Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the \u2018jsonpickle\u2019 Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation."
                }
              ],
              "value": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.\u003cbr\u003e\u003cbr\u003eThe Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the \u2018jsonpickle\u2019 Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-502",
                  "description": "The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.",
                  "lang": "en",
                  "type": "cwe"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-10T17:16:00.352Z",
            "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
            "shortName": "cisco"
          },
          "references": [
            {
              "url": "https://advisory.splunk.com/advisories/SVD-2026-0601"
            }
          ],
          "source": {
            "advisory": "SVD-2026-0601"
          },
          "title": "Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "assignerShortName": "cisco",
        "cveId": "CVE-2026-20251",
        "datePublished": "2026-06-10T17:16:00.352Z",
        "dateReserved": "2025-10-08T11:59:15.401Z",
        "dateUpdated": "2026-06-11T03:55:39.372Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0736

Vulnerability from certfr_avis - Published: 2026-06-11 - Updated: 2026-06-11

De multiples vulnérabilités ont été découvertes dans les produits Splunk. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une falsification de requêtes côté serveur (SSRF).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Splunk	Splunk Secure Gateway	Splunk Secure Gateway versions 3.10.x antérieures à 3.10.6
Splunk	Splunk Cloud Platform	Splunk Cloud Platform versions 10.1.2507.x antérieures à 10.1.2507.23
Splunk	Splunk Enterprise	Splunk Enterprise versions 9.3.x antérieures à 9.3.13
Splunk	Splunk Enterprise	Splunk Enterprise versions 9.4.x antérieures à 9.4.12
Splunk	SOAR	Splunk SOAR versions antérieures à 8.5.0
Splunk	Splunk Cloud Platform	Splunk Cloud Platform versions 9.3.2411.x antérieures à 9.3.2411.132
Splunk	Splunk Cloud Platform	Splunk Cloud Platform versions 10.2.2510.x antérieures à 10.2.2510.15
Splunk	Splunk Cloud Platform	Splunk Cloud Platform versions 10.3.2512.x antérieures à 10.3.2512.13
Splunk	Splunk Enterprise	Splunk Enterprise versions 10.0.x antérieures à 10.0.7
Splunk	Splunk Cloud Platform	Splunk Cloud Platform versions 10.4.2604.x antérieures à 10.4.2604.3
Splunk	Splunk Secure Gateway	Splunk Secure Gateway versions antérieures à 3.8.67
Splunk	Splunk Enterprise	Splunk Enterprise versions 10.2.x antérieures à 10.2.4
Splunk	Splunk Cloud Platform	Splunk Cloud Platform versions 10.0.2503.x antérieures à 10.0.2503.14
Splunk	Splunk Secure Gateway	Splunk Secure Gateway versions 3.9.x antérieures à 3.9.20

References

Title

Publication Time

Tags

Bulletin de sécurité Splunk SVD-2026-0612	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0602	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0610	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0601	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0603	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0608	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0609	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0611	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0606	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0605	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0604	2026-06-10	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0607	2026-06-10	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Splunk Secure Gateway versions 3.10.x ant\u00e9rieures \u00e0 3.10.6",
      "product": {
        "name": "Splunk Secure Gateway",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Cloud Platform versions 10.1.2507.x ant\u00e9rieures \u00e0 10.1.2507.23",
      "product": {
        "name": "Splunk Cloud Platform",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise versions 9.3.x ant\u00e9rieures \u00e0 9.3.13",
      "product": {
        "name": "Splunk Enterprise",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise versions 9.4.x ant\u00e9rieures \u00e0 9.4.12",
      "product": {
        "name": "Splunk Enterprise",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk SOAR versions ant\u00e9rieures \u00e0 8.5.0",
      "product": {
        "name": "SOAR",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Cloud Platform versions 9.3.2411.x ant\u00e9rieures \u00e0 9.3.2411.132",
      "product": {
        "name": "Splunk Cloud Platform",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Cloud Platform versions 10.2.2510.x ant\u00e9rieures \u00e0 10.2.2510.15",
      "product": {
        "name": "Splunk Cloud Platform",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Cloud Platform versions 10.3.2512.x ant\u00e9rieures \u00e0 10.3.2512.13",
      "product": {
        "name": "Splunk Cloud Platform",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise versions 10.0.x ant\u00e9rieures \u00e0 10.0.7",
      "product": {
        "name": "Splunk Enterprise",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Cloud Platform versions 10.4.2604.x ant\u00e9rieures \u00e0 10.4.2604.3",
      "product": {
        "name": "Splunk Cloud Platform",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Secure Gateway versions ant\u00e9rieures \u00e0 3.8.67",
      "product": {
        "name": "Splunk Secure Gateway",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise versions 10.2.x ant\u00e9rieures \u00e0 10.2.4",
      "product": {
        "name": "Splunk Enterprise",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Cloud Platform versions 10.0.2503.x ant\u00e9rieures \u00e0 10.0.2503.14",
      "product": {
        "name": "Splunk Cloud Platform",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Secure Gateway versions 3.9.x ant\u00e9rieures \u00e0 3.9.20",
      "product": {
        "name": "Splunk Secure Gateway",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-20260",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20260"
    },
    {
      "name": "CVE-2026-22701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22701"
    },
    {
      "name": "CVE-2025-61731",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-61731"
    },
    {
      "name": "CVE-2026-20259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20259"
    },
    {
      "name": "CVE-2026-2006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2006"
    },
    {
      "name": "CVE-2026-2005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2005"
    },
    {
      "name": "CVE-2026-24051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24051"
    },
    {
      "name": "CVE-2026-20256",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20256"
    },
    {
      "name": "CVE-2026-20257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20257"
    },
    {
      "name": "CVE-2026-1703",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1703"
    },
    {
      "name": "CVE-2026-27142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27142"
    },
    {
      "name": "CVE-2026-20255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20255"
    },
    {
      "name": "CVE-2026-20258",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20258"
    },
    {
      "name": "CVE-2026-34480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34480"
    },
    {
      "name": "CVE-2025-68161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68161"
    },
    {
      "name": "CVE-2025-61732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-61732"
    },
    {
      "name": "CVE-2025-68146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68146"
    },
    {
      "name": "CVE-2026-25679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
    },
    {
      "name": "CVE-2026-20252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20252"
    },
    {
      "name": "CVE-2026-1229",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1229"
    },
    {
      "name": "CVE-2026-20254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20254"
    },
    {
      "name": "CVE-2025-12818",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-12818"
    },
    {
      "name": "CVE-2026-4148",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4148"
    },
    {
      "name": "CVE-2025-8869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8869"
    },
    {
      "name": "CVE-2025-12817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-12817"
    },
    {
      "name": "CVE-2025-47913",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-47913"
    },
    {
      "name": "CVE-2025-58181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-58181"
    },
    {
      "name": "CVE-2026-27459",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
    },
    {
      "name": "CVE-2026-4147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4147"
    },
    {
      "name": "CVE-2025-47914",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-47914"
    },
    {
      "name": "CVE-2026-34516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34516"
    },
    {
      "name": "CVE-2026-27448",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27448"
    },
    {
      "name": "CVE-2026-20251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20251"
    },
    {
      "name": "CVE-2026-23490",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23490"
    },
    {
      "name": "CVE-2026-24049",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24049"
    },
    {
      "name": "CVE-2026-2003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2003"
    },
    {
      "name": "CVE-2026-4358",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4358"
    },
    {
      "name": "CVE-2025-68121",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
    },
    {
      "name": "CVE-2026-20253",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20253"
    },
    {
      "name": "CVE-2025-61726",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
    },
    {
      "name": "CVE-2026-34520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34520"
    },
    {
      "name": "CVE-2026-2004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2004"
    },
    {
      "name": "CVE-2026-34477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34477"
    }
  ],
  "initial_release_date": "2026-06-11T00:00:00",
  "last_revision_date": "2026-06-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0736",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Splunk. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Splunk",
  "vendor_advisories": [
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0612",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0612"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0602",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0602"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0610",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0610"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0601",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0601"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0603",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0603"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0608",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0608"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0609",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0609"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0611",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0611"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0606",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0606"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0605",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0605"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0604",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0604"
    },
    {
      "published_at": "2026-06-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0607",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0607"
    }
  ]
}

FKIE_CVE-2026-20251

Vulnerability from fkie_nvd - Published: 2026-06-10 18:16 - Updated: 2026-06-17 10:17

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@cisco.com	https://advisory.splunk.com/advisories/SVD-2026-0601	Vendor Advisory

Impacted products

Vendor	Product	Version
splunk	splunk	*
splunk	splunk	*
splunk	splunk	*
splunk	splunk	*
splunk	splunk_cloud_platform	*
splunk	splunk_cloud_platform	*
splunk	splunk_cloud_platform	*
splunk	splunk_cloud_platform	*
splunk	splunk_secure_gateway	*
splunk	splunk_secure_gateway	*
splunk	splunk_secure_gateway	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "10.2.4",
              "status": "affected",
              "version": "10.2",
              "versionType": "custom"
            },
            {
              "lessThan": "10.0.7",
              "status": "affected",
              "version": "10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "9.4.12",
              "status": "affected",
              "version": "9.4",
              "versionType": "custom"
            },
            {
              "lessThan": "9.3.13",
              "status": "affected",
              "version": "9.3",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Cloud Platform",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "10.3.2512.12",
              "status": "affected",
              "version": "10.3.2512",
              "versionType": "custom"
            },
            {
              "lessThan": "10.2.2510.14",
              "status": "affected",
              "version": "10.2.2510",
              "versionType": "custom"
            },
            {
              "lessThan": "10.1.2507.22",
              "status": "affected",
              "version": "10.1.2507",
              "versionType": "custom"
            },
            {
              "lessThan": "9.3.2411.132",
              "status": "affected",
              "version": "9.3.2411",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Splunk Secure Gateway",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "3.10.6",
              "status": "affected",
              "version": "3.10",
              "versionType": "custom"
            },
            {
              "lessThan": "3.9.20",
              "status": "affected",
              "version": "3.9",
              "versionType": "custom"
            },
            {
              "lessThan": "3.8.67",
              "status": "affected",
              "version": "3.8",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "B9D80F1C-F849-4D62-B82A-6B8963EEEBFB",
              "versionEndExcluding": "9.3.13",
              "versionStartIncluding": "9.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "423B8DF2-B7A5-41AA-9CFD-75B2FD503ACC",
              "versionEndExcluding": "9.4.12",
              "versionStartIncluding": "9.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "0C9F1DED-280E-4C76-A867-A7A8FCBD1F7A",
              "versionEndExcluding": "10.0.7",
              "versionStartIncluding": "10.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "E3B992C0-AD5E-43A1-BAA3-6B11FFD5D750",
              "versionEndExcluding": "10.2.4",
              "versionStartIncluding": "10.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "88A68C7C-BE2C-465C-812B-8F211A8AE935",
              "versionEndExcluding": "9.3.2411.132",
              "versionStartIncluding": "9.3.2411",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "13BDF451-89BD-4E5B-8DCB-16BF9AE81FAC",
              "versionEndExcluding": "10.1.2507.22",
              "versionStartIncluding": "10.1.2507",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE580133-150E-4007-989F-00491BF7A064",
              "versionEndExcluding": "10.2.2510.14",
              "versionStartIncluding": "10.2.2510",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D78DAE10-4B29-4B44-B09A-041500E22CEF",
              "versionEndExcluding": "10.3.2512.12",
              "versionStartIncluding": "10.3.2512",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B9361838-B66C-4485-898F-6A3FFD401DEA",
              "versionEndExcluding": "3.8.67",
              "versionStartIncluding": "3.8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A2F72B2-2F09-4EA8-8AFB-D35FC5652117",
              "versionEndExcluding": "3.9.20",
              "versionStartIncluding": "3.9.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "25DD95BD-64E4-4DCC-BBD3-05CD8D168D50",
              "versionEndExcluding": "3.10.6",
              "versionStartIncluding": "3.10.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.\u003cbr\u003e\u003cbr\u003eThe Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the \u2018jsonpickle\u2019 Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation."
    }
  ],
  "id": "CVE-2026-20251",
  "lastModified": "2026-06-17T10:17:19.723",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-20251",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-10T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-10T18:16:40.477",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0601"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    }
  ]
}

GHSA-3CRW-7XG9-FPXG

Vulnerability from github – Published: 2026-06-10 18:31 – Updated: 2026-06-10 18:31

Details

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.

The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-20251"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-10T18:16:40Z",
    "severity": "HIGH"
  },
  "details": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.\u003cbr\u003e\u003cbr\u003eThe Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the \u2018jsonpickle\u2019 Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.",
  "id": "GHSA-3crw-7xg9-fpxg",
  "modified": "2026-06-10T18:31:46Z",
  "published": "2026-06-10T18:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20251"
    },
    {
      "type": "WEB",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0601"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2026-0198

Vulnerability from csaf_ncscnl - Published: 2026-06-15 08:27 - Updated: 2026-06-19 12:42

Summary

Kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform

Scope

9 vulnerabilities in this advisory, including CVE-2026-20251.

CVE-2026-20251

A Remote Code Execution vulnerability in Splunk Enterprise, Splunk Cloud Platform, and Splunk Secure Gateway allows low-privileged users to execute arbitrary code via unsafe deserialization of KV Store data using the 'jsonpickle' Python library.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Known affected: 4 products

Open the full advisory

WID-SEC-W-2026-1877

Vulnerability from csaf_certbund - Published: 2026-06-10 22:00 - Updated: 2026-06-14 22:00

Summary

Splunk Enterprise: Mehrere Schwachstellen

Severity

Hoch

Scope

9 vulnerabilities in this advisory, including CVE-2026-20251.

CVE-2026-20251

Known affected: 5 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-20251 (GCVE-0-2026-20251)

CERTFR-2026-AVI-0736

Solutions

FKIE_CVE-2026-20251

GHSA-3CRW-7XG9-FPXG

NCSC-2026-0198

WID-SEC-W-2026-1877

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour