Skip to content
OpenAdvisories
High 1 exploited CVE NCSC-2026-0198 9 CVEs

Kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform

Published Jun 15, 2026 · Updated Jun 19, 2026 · Revision 2 · nl

Vendor: Splunk Product: Cloud Platform Product: Enterprise Product: Secure Gateway Product: splunk

Summary

Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform.

Details

Interpretaties
De kwetsbaarheden betreffen verschillende onderdelen van Splunk Enterprise en Splunk Cloud Platform. Splunk heeft de kwetsbaarheid met kenmerk CVE-2026-20253 in de PostgreSQL sidecar service endpoint als kritiek beoordeeld en maakt het mogelijk voor niet-geauthenticeerde gebruikers om willekeurige bestanden aan te maken of te verwijderen door het ontbreken van authenticatiecontroles.
Een andere kwetsbaarheid met kenmerk CVE-2026-20251 betreft een Remote Code Execution (RCE) via onveilige deserialisatie van KV Store data met de 'jsonpickle' Python library, waarbij laaggeprivilegieerde gebruikers zonder admin- of power-rollen code op afstand kunnen uitvoeren.
Verder zijn meerdere kwetsbaarheden vastgesteld die het mogelijk maken om gevoelige gegevens te exfiltreren via onder meer SSRF-, CSS-injectie- en XSS-aanvallen. Door onvoldoende validatie van URL’s, domeinen en gebruikersinvoer kunnen aanvallers beveiligingscontroles omzeilen, interne systemen benaderen en data buitmaken.

Update: Het Splunk Product Security Incident Response Team (PSIRT) meldt dat beperkt en gericht misbruik is waargenomen van de kwetsbaarheid met kenmerk CVE-2026-20253. De kwetsbaarheid maakt het voor een kwaadwillende mogelijk om bestanden aan te maken of verwijderen en zo de werking van het systeem te verstoren. Voor zover bekend is uitvoer van code niet mogelijk.

Oplossingen
Splunk heeft updates uitgebracht om de kwetsbaarheden in Splunk Enterprise en Splunk Cloud Platform te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 9

  • Critical 9.8
    CVE-2026-20253 Exploited Public exploit Scanner template EPSS 97%

    Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

    In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpo…

    Splunk Splunk Enterprise
    KEV Jun 18, 2026
  • High 8.8
    CVE-2026-20251 Public exploit EPSS 31%

    Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user…

    Splunk Splunk Enterprise Splunk Cloud Platform Splunk Secure Gateway
  • High 7.6
    CVE-2026-20252

    Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk ro…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.1
    CVE-2026-20258

    Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could sto…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2026-20254

    Information Disclosure through External Content Restriction Bypass in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could cra…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2026-20255

    Improper Input Validation through Classic Dashboards in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cra…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2026-20256

    Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could cau…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2026-20257

    Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cra…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.5
    CVE-2026-20259

    Improper Access Control in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, and 9.3.2411.131, a user who holds a Splunk role that contains the high-privilege capability `…

    Splunk Splunk Enterprise Splunk Cloud Platform

Revision history

  1. #1.0.1

    Er is actief misbruik waargenomen van CVE-2026-20253 door Splunk Product Security Incident Response Team (PSIRT) in juni.

  2. #1.0.0

    Initiele versie

References

  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0601
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0602
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0603
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0604
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0605
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0606
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0607
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0608
  • Reference
    https://advisory.splunk.com/advisories/SVD-2026-0609