Description
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Splunk | Splunk Enterprise | 10.2 – < 10.2.4, 10.0 – < 10.0.7, 9.4 – < 9.4.12, 9.3 – < 9.3.13 | 10.2.4 |
| Splunk | Splunk Cloud Platform | 10.3.2512 – < 10.3.2512.12, 10.2.2510 – < 10.2.2510.14, 10.1.2507 – < 10.1.2507.22, 9.3.2411 – < 9.3.2411.132 | 10.3.2512.12 |
| Splunk | Splunk Secure Gateway | 3.10 – < 3.10.6, 3.9 – < 3.9.20, 3.8 – < 3.8.67 | 3.10.6 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
reactivezero/CVE-2026-20251 ★ 3 · Jun 26, 2026
CVE-2026-20251 — Splunk Secure Gateway jsonpickle deserialization RCE (CVSS 8.8) | ReactiveZero Security Research
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- NCSC-2026-0198 Kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform NCSC-NL (Netherlands) · Jun 19, 2026
- WID-SEC-2026-1877 Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 18, 2026