Skip to content
OpenAdvisories

Vendor

Splunk

347 known vulnerabilities.

Products

Splunk Enterprise 259 Splunk Cloud Platform 89 Splunk SOAR 31 Splunk Secure Gateway 20 Splunk AI Toolkit 12 Splunk Cloud 11 Splunk Enterprise Cloud 5 Splunk Connect for Kafka 4 Splunk Light 4 Splunk Add-on Builder 3 AD LDAP app for Splunk SOAR 3 Splunk App for Lookup File Editing 3 Splunk MCP Server 3 Universal Forwarder 3 Splunk Enterprise Security (ES) 2 Cisco Talos Intelligence for Enterprise Security Cloud 2 Splunk Enterprise Security 2 Zoom app for Splunk SOAR 1 Splunk App for SOAR 1 Splunk/UniversalForwarder for Windows 1 Splunk Add-on for Palo Alto Networks 1 Splunk Supporting Add-on for Active Directory 1 Splunk CloudConnect SDK 1 Splunk App for Stream 1 AWS IAM app for Splunk SOAR 1 Universal Forwarders 1 Splunk On-Call (VictorOps) 1 Cisco Webex app for Splunk SOAR 1 MS Graph for Active Directory app for Splunk SOAR 1 RSA SecurID Authentication Manager app for Splunk SOAR 1 Splunk MCP Server app 1 Nmap Scanner 1 Splunk Attack Analyzer Connector for Splunk SOAR 1 Splunk SOAR (On-premises) 1 Venafi app for Splunk SOAR 1 Splunk SOAR (Cloud) 1 Cisco Secure Malware Analytics app for Splunk SOAR 1 CrowdStrike OAuth API app for Splunk SOAR 1 Splunk ITSI 1 FireAMP 1
All Critical High Medium Low Exploited only Public exploit

347 results · Feed

  • Medium 6.4
    CVE-2026-76255

    Risky Command Safeguards Bypass through Splunk Web in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language (SPL) commands through the Data Model Editor using …

    Splunk Splunk Enterprise
  • High 8.8
    CVE-2026-76253

    Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could run arbitrary Search Processing Language (SPL) commands with the highest level of system privilege and read every creden…

    Splunk Splunk Enterprise
  • High 7.1
    CVE-2026-76251

    Missing Authorization through REST API Endpoints in the Splunk App for Splunk Observability Cloud

    In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Obse…

    Splunk Splunk Enterprise
  • Medium 6.8
    CVE-2026-76252

    Cross-Site Scripting (XSS) through Splunk Web Message Validation in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized JavaScript in that user's browser. This could allow for unauthorized access to al…

    Splunk Splunk Enterprise
  • Medium 5.3
    CVE-2026-20298

    Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the 'admin' or 'power' Splunk rol…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.3
    CVE-2026-20296

    SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.2
    CVE-2026-20297

    Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` c…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Critical 9.1
    CVE-2026-20266

    OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit

    In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is possible because of an unsafe shell execution pattern in the btool…

    Splunk Splunk AI Toolkit
  • Medium 4.3
    CVE-2026-20265

    Insecure Default Domain Allowlist in Splunk AI Toolkit

    In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause the Splunk AI Toolkit to make outbound requests over HTTP to a server that an attacker controls, which could allow for data exf…

    Splunk Splunk AI Toolkit
  • High 7.1
    CVE-2026-20258

    Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could sto…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Critical 9.8
    CVE-2026-20253 Exploited Public exploit Scanner template EPSS 97%

    Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

    In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpo…

    Splunk Splunk Enterprise
    KEV Jun 18, 2026
  • Medium 4.3
    CVE-2026-20260

    Log Injection through HTTP Request Paths in Splunk SOAR

    In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute (ANSI) escape codes into SOAR application log files through specially crafted HTTP request p…

    Splunk Splunk SOAR
  • High 7.6
    CVE-2026-20252

    Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk ro…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2026-20257

    Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cra…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.5
    CVE-2026-20259

    Improper Access Control in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, and 9.3.2411.131, a user who holds a Splunk role that contains the high-privilege capability `…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2026-20255

    Improper Input Validation through Classic Dashboards in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cra…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.8
    CVE-2026-20251 Public exploit EPSS 31%

    Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user…

    Splunk Splunk Enterprise Splunk Cloud Platform Splunk Secure Gateway
  • Medium 5.7
    CVE-2026-20254

    Information Disclosure through External Content Restriction Bypass in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could cra…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2026-20256

    Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could cau…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2026-20238

    Improper Access Control through Role Inheritance in Splunk AI Toolkit app

    In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data that was restricted through `srchFilter` configurations on custom roles.<br><br>The app contains an `authorize.conf…

    Splunk Splunk AI Toolkit
  • High 7.5
    CVE-2026-20239

    Sensitive Information Disclosure through Log Files in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the `_internal` index could view session cookies and response bodi…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.1
    CVE-2026-20240

    Denial of Service through coldToFrozen.sh Script in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the ‘admin’ or ‘pow…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.2
    CVE-2026-20205

    Sensitive Information Disclosure in ''_internal'' index in Splunk MCP Server app

    In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability `mcp_tool_admin` could view users session and authorization tokens in clear text.<br><br>The vulnera…

    Splunk Splunk MCP Server
  • Medium 4.3
    CVE-2026-20203

    Improper Access Control in Data Model Acceleration in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `pow…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.1
    CVE-2026-20204

    Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `powe…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.6
    CVE-2026-20202

    Improper Input Validation during User Account Creation in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.20, 10.0.2503.13, and 9.3.2411.127, a user who holds a role that contains the high-privilege cap…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 8.0
    CVE-2026-20163

    Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability `edit_cmd` could exe…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.3
    CVE-2026-20162

    Stored Cross-Site Scripting (XSS) through Path Traversal in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.9, and Splunk Cloud Platform versions below 10.2.2510.4, 10.1.2507.15, 10.0.2503.11, and 9.3.2411.123, a low-privileged user who does not hold the "admin" or "power" Splunk roles could craft a…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.4
    CVE-2026-20166

    Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise

    In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve the Observability Cloud AP…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.5
    CVE-2026-20164

    Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, 10.0.2503.11, and 9.3.2411.123, a low-privileged user that does not hold the "admin" or "power" Splunk roles could acces…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.3
    CVE-2026-20165

    Sensitive Information Disclosure in MongoClient logging channel in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.1, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.7, 10.1.2507.17, 10.0.2503.12, and 9.3.2411.124, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retri…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.8
    CVE-2026-20142

    Sensitive Information Disclosure in "_internal" index in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the RSA `accessKey` value from the [<u>Authentication…

    Splunk Splunk Enterprise
  • Medium 6.8
    CVE-2026-20138

    Sensitive Information Disclosure in "_internal" index in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the `integrationKey`, `secretKey`, and `appSecretKey`…

    Splunk Splunk Enterprise
  • Medium 4.3
    CVE-2026-20139

    Client-Side Denial of Service (DoS) through ''/splunkd/__raw/services/authentication/users/username'' REST API endpoint in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.8
    CVE-2026-20144

    Sensitive Information Disclosure in ''_internal'' index in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 10.2.2510.0, 10.1.2507.11, 10.0.2503.9, and 9.3.2411.120, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with acce…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2026-20141

    Improper Access Control in Splunk Monitoring Console App

    In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user who does not hold the "admin" Splunk role could access the Splunk Monitoring Console App endpoints due to an improper access control. This could lead to a sensitive in…

    Splunk Splunk Enterprise
  • Low 3.5
    CVE-2026-20137

    Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise

    In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, and 9.3.2408.122, a low-privileged user who does not hold the "admin" or "power" Splunk roles could b…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Low 2.7
    CVE-2025-20388

    Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumer…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2025-20389

    Improper Input Validation in "label" column field in Splunk Secure Gateway App

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cr…

    Splunk Splunk Enterprise Splunk Cloud Platform Splunk Secure Gateway
  • High 8.0
    CVE-2025-20387

    Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade

    In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory.…

    Splunk Splunk Enterprise