Analytical use of cookies
CVE-2026-20251: splunk vulnerability
CVE-2026-20251: high vulnerability affecting splunk. Check CVSS, KEV status, business impact and recommended administrator actions.
- CVSS
- 8.8 HIGH
- EPSS
- 97.01%
- Known exploited
- not in KEV
- Product
- splunk
What is known
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.
Business impact
Successful exploitation of CVE-2026-20251, a high vulnerability (CVSS 8.8) affecting splunk, may affect the confidentiality, integrity or availability of the vulnerable environment. The exact impact depends on the installed version, exposed interfaces and deployment configuration.
Recommended administrator action
Confirm whether splunk is present and compare installed versions with the vendor advisory and NVD record. Apply the vendor patch or documented mitigation; until remediation is complete, reduce exposure of affected interfaces, review relevant logs and monitor for indicators of exploitation. DataHouse can support version verification, managed patching, network exposure reduction, log review and backup validation for dedicated, cloud and colocated environments.