This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Splunk fixes 12 vulnerabilities

Splunk fixes 12 vulnerabilities in various products. The most severe of them are described below, the others can be found at [1]. Individual products and their fixed versions: Splunk SOAR – 8.5.0 [2] Splunk Enterprise – 10.4.0, 10.2.4, 10.0.7, 9.4.12, 9.3.13 [3][4][5][6][7][8][9][10][11] Splunk Cloud Platform – 10.4.2604.0, 10.4.2604.3, 10.3.2512.11, 10.3.2512.12, 10.3.2512.13, 10.2.2510.14, 10.2.2510.15, 10.1.2507.22, 10.1.2507.23, 10.0.2503.14, 9.3.2411.131, 9.3.2411.132 [3][4][5][6][7][8][9][10][11] Splunk Secure Gateway – 3.10.6, 3.9.20, 3.8.67 [11]

Splunk Enterprise, Splunk Cloud Platform - missing authentication (CVE-2026-20253)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can create or truncate arbitrary files in Splunk Enterprise and Splunk Cloud Platform due to missing authentication checks in the PostgreSQL sidecar service endpoint [9].

The vulnerability is present in products:

  • Splunk Enterprise; >=10.2.0, <=10.2.3; >=10.0.0, <=10.0.6
  • Splunk Cloud Platform; <10.4.2604.3; <10.2.2510.14

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 10. 6. 2026.

Splunk Enterprise, Splunk Cloud Platform - SSRF (CVE-2026-20252)
CVSS 7.6 (High)

An authenticated attacker with low privileges can carry out SSRF attacks against internal targets in Splunk Cloud Platform and Splunk Enterprise due to faulty domain validation and automatic redirection in the PDF export [10].

The vulnerability is present in products:

  • Splunk Enterprise; >=10.2.0, <=10.2.3; >=10.0.0, <10.0.6; >=9.4.0, <9.4.11; >=9.3.0, <9.3.12
  • Splunk Cloud Platform; >=10.4.2604, <10.4.2604.3; >=10.3.2512, <10.3.2512.12; >=10.2.2510, <10.2.2510.14; >=10.1.2507, <10.1.2507.22; >=9.3.2411, <9.3.2411.132

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

More information:

The vulnerability was publicly disclosed 10. 6. 2026.

Splunk Enterprise, Splunk Cloud Platform, Splunk Secure Gateway - RCE (CVE-2026-20251)
CVSS 8.8 (High)

An authenticated remote attacker with low privileges can execute arbitrary code in Splunk Enterprise, Splunk Cloud Platform and Splunk Secure Gateway due to unsafe deserialization of KV Store data in the Splunk Secure Gateway application [11].

The vulnerability is present in products:

  • Splunk Enterprise; >=10.2.0, <10.2.3; >=10.0.0, <10.0.6; >=9.4.0, <9.4.11; >=9.3.0, <9.3.12
  • Splunk Cloud Platform; >=10.3.2512, <10.3.2512.12; >=10.2.2510, <10.2.2510.14; >=10.1.2507, <10.1.2507.22; >=9.3.2411, <9.3.2411.132
  • Splunk Secure Gateway; >=3.10, <3.10.6; >=3.9, <3.9.20; >=3.8, <3.8.67

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 10. 6. 2026.

Splunk Enterprise, Splunk Cloud Platform - stored XSS (CVE-2026-20258)
CVSS 7.1 (High)

An authenticated remote attacker with low privileges can exploit a stored XSS vulnerability and, after interaction by the targeted user, execute arbitrary JavaScript in that user's browser in Splunk Enterprise and Splunk Cloud Platform due to insufficient sanitization of the HTML panel of the classic dashboard [4].

The vulnerability is present in products:

  • Splunk Enterprise; >=10.2.0, <10.2.3; >=10.0.0, <10.0.6; >=9.4.0, <9.4.11; >=9.3.0, <9.3.12
  • Splunk Cloud Platform; >=10.3.2512, <10.3.2512.11; >=10.2.2510, <10.2.2510.15; >=10.1.2507, <10.1.2507.23; >=9.3.2411, <9.3.2411.132

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-20258 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 10. 6. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 11. 6. 2026.

CESNET, z.s.p.o. Logo