This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Splunk fixes 35 vulnerabilities in various products

Splunk fixes 35 vulnerabilities in various products. The most severe ones are described below [1][2][3][4], the others can be found at [5][6][7][8][9][10]. Individual products and their fixed versions: Splunk Enterprise - 10.2.0, 10.0.3, 9.4.8, 9.3.9, 9.2.12 [1][2][4][5][6][8][9][10] Splunk Universal Forwarder - 10.0.3, 9.4.8, 9.3.9, 9.2.12 [7] Splunk Cloud Platform - 10.2.2510.3, 10.1.2507.11, 10.0.2503.9, 9.3.2411.121[9][10] Splunk DB Connect - 4.2.0 [3]

Splunk Enterprise for Windows - LPE, DoS (CVE-2026-20143)
CVSS 7.7 (High)

Due to an insecure Python module search path in Splunk Enterprise for Windows, an authenticated local user can run a malicious script after a service restart and escalate privileges or cause a DoS [1].

The vulnerability is present in product:

  • Splunk Enterprise; >=10.0.0, <10.0.3; >=9.4.0, <9.4.8; >=9.3.0, <9.3.9;

CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 18. 2. 2026.

Splunk Enterprise for Windows - LPE (CVE-2026-20140)
CVSS 7.7 (High)

Due to an incorrect library search order in Splunk Enterprise for Windows, an authenticated local user can load a malicious library after a service restart and escalate privileges [2].

The vulnerability is present in product:

  • Splunk Enterprise; >=10.0.0, <10.0.3; >=9.4.0, <9.4.8; >=9.3.0, <9.3.9; >=9.2.0, <9.2.12

CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 18. 2. 2026.

Splunk DB Connect – DoS (CVE-2026-21441)
CVSS 8.9 (High)

Through the urllib3 library used in Splunk DB Connect, an unauthenticated remote attacker can cause excessive data decompression when handling HTTP request redirects, which may lead to a DoS attack. If the product cannot be updated immediately, it is recommended to disable redirect handling when communicating with untrusted sources by setting "redirect=False" [3].

The vulnerability is present in product:

  • Splunk DB Connect; <4.2.0;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

More information:

The vulnerability was publicly disclosed 18. 2. 2026.

Splunk Enterprise – Request Smuggling (CVE-2025-22871)
CVSS 9.1 (Critical)

Due to incorrect HTTP request handling in the golang library (net/http package) used in Splunk Enterprise, an unauthenticated remote attacker can smuggle their own request into ongoing communication [4].

The vulnerability is present in product:

  • Splunk Enterprise; >=10.0.0, <10.0.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 18. 2. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 23. 2. 2026.

CESNET, z.s.p.o. Logo