Skip to content
OpenAdvisories

Vendor

Splunk

347 known vulnerabilities.

Products

Splunk Enterprise 259 Splunk Cloud Platform 89 Splunk SOAR 31 Splunk Secure Gateway 20 Splunk AI Toolkit 12 Splunk Cloud 11 Splunk Enterprise Cloud 5 Splunk Connect for Kafka 4 Splunk Light 4 Splunk Add-on Builder 3 AD LDAP app for Splunk SOAR 3 Splunk App for Lookup File Editing 3 Splunk MCP Server 3 Universal Forwarder 3 Splunk Enterprise Security (ES) 2 Cisco Talos Intelligence for Enterprise Security Cloud 2 Splunk Enterprise Security 2 Zoom app for Splunk SOAR 1 Splunk App for SOAR 1 Splunk/UniversalForwarder for Windows 1 Splunk Add-on for Palo Alto Networks 1 Splunk Supporting Add-on for Active Directory 1 Splunk CloudConnect SDK 1 Splunk App for Stream 1 AWS IAM app for Splunk SOAR 1 Universal Forwarders 1 Splunk On-Call (VictorOps) 1 Cisco Webex app for Splunk SOAR 1 MS Graph for Active Directory app for Splunk SOAR 1 RSA SecurID Authentication Manager app for Splunk SOAR 1 Splunk MCP Server app 1 Nmap Scanner 1 Splunk Attack Analyzer Connector for Splunk SOAR 1 Splunk SOAR (On-premises) 1 Venafi app for Splunk SOAR 1 Splunk SOAR (Cloud) 1 Cisco Secure Malware Analytics app for Splunk SOAR 1 CrowdStrike OAuth API app for Splunk SOAR 1 Splunk ITSI 1 FireAMP 1
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-76268 Public exploit

    Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled …

    Splunk Splunk Enterprise
  • Critical 9.8
    CVE-2026-20253 Exploited Public exploit EPSS 97%

    Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

    In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpo…

    Splunk Splunk Enterprise
    KEV Jun 18, 2026
  • High 8.8
    CVE-2026-20251 Public exploit EPSS 31%

    Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user…

    Splunk Splunk Enterprise Splunk Cloud Platform Splunk Secure Gateway
  • Medium 5.3
    CVE-2025-20384 Public exploit

    Unauthenticated Log Injection in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (ANSI) escape codes int…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.5
    CVE-2024-36991 Public exploit EPSS 13%

    Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows

    In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2024-36985 Public exploit

    Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.

    Splunk Splunk Enterprise
  • High 8.0
    CVE-2023-46214 Public exploit EPSS 89%

    Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

    In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code exec…

    Splunk Splunk Enterprise Splunk Cloud
  • High 8.8
    CVE-2023-32707 Public exploit EPSS 79%

    ‘edit_user’ Capability Privilege Escalation

    In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admi…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2023-22941 Public exploit

    Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon

    In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, an improperly-formatted ‘INGEST_EVAL’ parameter in a Field Transformation crashes the Splunk daemon (splunkd).

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.8
    CVE-2022-43571 Public exploit EPSS 19%

    Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

    In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.

    Splunk Splunk Enterprise