Skip to content
OpenAdvisories

Vendor

Splunk

347 known vulnerabilities.

Products

Splunk Enterprise 259 Splunk Cloud Platform 89 Splunk SOAR 31 Splunk Secure Gateway 20 Splunk AI Toolkit 12 Splunk Cloud 11 Splunk Enterprise Cloud 5 Splunk Connect for Kafka 4 Splunk Light 4 Splunk Add-on Builder 3 AD LDAP app for Splunk SOAR 3 Splunk App for Lookup File Editing 3 Splunk MCP Server 3 Universal Forwarder 3 Splunk Enterprise Security (ES) 2 Cisco Talos Intelligence for Enterprise Security Cloud 2 Splunk Enterprise Security 2 Zoom app for Splunk SOAR 1 Splunk App for SOAR 1 Splunk/UniversalForwarder for Windows 1 Splunk Add-on for Palo Alto Networks 1 Splunk Supporting Add-on for Active Directory 1 Splunk CloudConnect SDK 1 Splunk App for Stream 1 AWS IAM app for Splunk SOAR 1 Universal Forwarders 1 Splunk On-Call (VictorOps) 1 Cisco Webex app for Splunk SOAR 1 MS Graph for Active Directory app for Splunk SOAR 1 RSA SecurID Authentication Manager app for Splunk SOAR 1 Splunk MCP Server app 1 Nmap Scanner 1 Splunk Attack Analyzer Connector for Splunk SOAR 1 Splunk SOAR (On-premises) 1 Venafi app for Splunk SOAR 1 Splunk SOAR (Cloud) 1 Cisco Secure Malware Analytics app for Splunk SOAR 1 CrowdStrike OAuth API app for Splunk SOAR 1 Splunk ITSI 1 FireAMP 1
All Critical High Medium Low Exploited only Public exploit

123 results · Clear filters · Feed

  • High 7.3
    CVE-2026-76325

    Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute…

    Splunk Splunk Enterprise
  • High 7.3
    CVE-2026-76321

    SPL Injection through Nearby Event Searches in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could inject arbitrary Search Processing Language (SPL) into requests that search for events near a selected event. This could allow for unauthorized search execut…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76319

    Remote Code Execution (RCE) through Federated Search in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fsh_manage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all releva…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76316

    Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language (SPL) pipeline that runs when an administrator opens the Add Data forwarder workf…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76317

    Path Traversal through the Lookup Configuration REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could move files that the user account running Splunk Enterprise can read into a lookup that the user controls. The user could…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76314

    Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution (RCE) by submitting crafted Splunk Web Manager Configuration content. The user could then …

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76315

    Code Injection through Splunk Web Manager Configuration in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then acc…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76313

    Remote Code Execution (RCE) through the REST API in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution (RCE) by uploading a malicious knowledge bundle and causing it to be used by distributed s…

    Splunk Splunk Enterprise
  • High 7.5
    CVE-2026-76262

    Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise

    In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnera…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76259

    Improper Privilege Management on the Management Port in Splunk Enterprise for Windows

    In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, a…

    Splunk Splunk Enterprise
  • High 7.5
    CVE-2026-76254

    SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language (SPL) pipelines from Dataset Explorer with the same privileges as that user, whic…

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76253

    Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could run arbitrary Search Processing Language (SPL) commands with the highest level of system privilege and read every creden…

    Splunk Splunk Enterprise
  • High 7.1
    CVE-2026-76251

    Missing Authorization through REST API Endpoints in the Splunk App for Splunk Observability Cloud

    In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Obse…

    Splunk Splunk Enterprise
  • High 8.3
    CVE-2026-20296

    SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.2
    CVE-2026-20297

    Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` c…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.1
    CVE-2026-20258

    Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could sto…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.6
    CVE-2026-20252

    Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk ro…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.8
    CVE-2026-20251 Public exploit EPSS 31%

    Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user…

    Splunk Splunk Enterprise Splunk Cloud Platform Splunk Secure Gateway
  • High 7.5
    CVE-2026-20239

    Sensitive Information Disclosure through Log Files in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the `_internal` index could view session cookies and response bodi…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.1
    CVE-2026-20240

    Denial of Service through coldToFrozen.sh Script in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the ‘admin’ or ‘pow…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.2
    CVE-2026-20205

    Sensitive Information Disclosure in ''_internal'' index in Splunk MCP Server app

    In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability `mcp_tool_admin` could view users session and authorization tokens in clear text.<br><br>The vulnera…

    Splunk Splunk MCP Server
  • High 7.1
    CVE-2026-20204

    Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `powe…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.0
    CVE-2026-20163

    Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability `edit_cmd` could exe…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.0
    CVE-2025-20387

    Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade

    In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory.…

    Splunk Splunk Enterprise
  • High 8.0
    CVE-2025-20386

    Incorrect permission assignment on Splunk Enterprise for Windows during new installation or upgrade

    In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Splunk Enterprise for Windows Installation directory. This lets …

    Splunk Splunk Enterprise
  • High 7.5
    CVE-2025-20371

    Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.0
    CVE-2025-20298

    Incorrect permission assignment on Universal Forwarder for Windows during new installation or upgrade

    In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory (by defau…

    Splunk Splunk/UniversalForwarder for Windows Windows
  • High 8.0
    CVE-2025-20229 EPSS 16%

    Remote Code Execution through file upload to “$SPLUNK_HOME/var/run/splunk/apptemp“ directory in Splunk Enterprise

    In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remo…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.1
    CVE-2025-20231

    Sensitive Information Disclosure in Splunk Secure Gateway App

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a search…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • High 8.8
    CVE-2024-53247

    Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway app

    In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.4.261 and 3.7.13 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could perform a Remote C…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • High 8.8
    CVE-2024-45733

    Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows

    In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration.

    Splunk Splunk Enterprise
  • High 7.1
    CVE-2024-45732

    Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app

    In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could r…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.0
    CVE-2024-45731

    Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk

    In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32…

    Splunk Splunk Enterprise
  • High 7.5
    CVE-2024-36982

    Denial of Service through null pointer reference in “cluster/config” REST endpoint

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the S…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.5
    CVE-2024-36991 Public exploit Scanner template EPSS 13%

    Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows

    In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2024-36985 Public exploit

    Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2024-36984

    Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code.

    Splunk Splunk Enterprise
  • High 8.0
    CVE-2024-36983

    Command Injection using External Lookups

    In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.2
    CVE-2024-29945

    Splunk Authentication Token Exposure in Debug Log in Splunk Enterprise

    In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process. This exposure happens when either Splunk Enterprise runs in debug mode or the JsonWebToken component has b…

    Splunk Splunk Enterprise
  • High 8.1
    CVE-2024-29946

    Risky command safeguards bypass in Dashboard Examples Hub

    In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phi…

    Splunk Splunk Enterprise Splunk Cloud Platform