CVEFinder.io

CVE-2026-20251

⚠️ high
🔍 Scan for this CVE
Summary

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store

Description

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.

CVSS Score
8.8
High
EPSS Score
0.6
Exploit Probability
Published Date
2026-06-10
First Seen: 2026-06-11
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 81.1% of all 338,292 vulnerabilities in our database.

#64,055
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jun 10, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
M Mahdan Argya Syarif (0xbeludan)
SSVC data provided by CISA
Last Modified 2026-06-15
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-502

📦 Affected Products 11

Vendor Product Status Affected Versions
splunk splunk Affected
> 10.0.0 < 10.0.7
splunk splunk Affected
> 10.2.0 < 10.2.4
splunk splunk Affected
> 9.3.0 < 9.3.13
splunk splunk Affected
> 9.4.0 < 9.4.12
splunk splunk_cloud_platform Affected
> 10.1.2507 < 10.1.2507.22
splunk splunk_cloud_platform Affected
> 10.2.2510 < 10.2.2510.14
splunk splunk_cloud_platform Affected
> 10.3.2512 < 10.3.2512.12
splunk splunk_cloud_platform Affected
> 9.3.2411 < 9.3.2411.132
splunk splunk_secure_gateway Affected
> 3.10.0 < 3.10.6
splunk splunk_secure_gateway Affected
> 3.8.0 < 3.8.67
splunk splunk_secure_gateway Affected
> 3.9.0 < 3.9.20

🔗 References 1

https://advisory.splunk.com/advisories/SVD-2026-0601
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-20296 ⚠️ high 8.3 0.2 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.26... 2026-07-15
CVE-2026-20297 ⚠️ high 7.2 0.5 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below... 2026-07-15
CVE-2026-20298 🔶 medium 5.3 0.2 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.26... 2026-07-15
CVE-2026-20252 ⚠️ high 7.6 0.3 In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.26... 2026-06-10
CVE-2026-20253 ⛔ critical 9.8 96.2 In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or tr... 2026-06-10
CVE-2026-20254 🔶 medium 5.7 0.3 In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.25... 2026-06-10
These CVEs affect the same products