Splunk Enterprise

CVEs (244)

• CVE-2026-76314HigAug 19, 2026
  Splunk

  Splunk Enterprise
  risk 0.57cvss 8.8epss 0.01

  In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution (RCE) by submitting crafted Splunk Web Manager Configuration content. The user could then access all relevant…

• CVE-2026-76313HigAug 19, 2026
  Splunk

  Splunk
  risk 0.57cvss 8.8epss 0.01

  In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution (RCE) by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can…

• CVE-2026-76259HigAug 19, 2026
  Splunk

  Splunk Enterprise
  risk 0.57cvss 8.8epss 0.00

  In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, and use those tokens…

• CVE-2026-76253HigAug 19, 2026
  Splunk

  Splunk Enterprise
  risk 0.57cvss 8.8epss 0.00

  In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could run arbitrary Search Processing Language (SPL) commands with the highest level of system privilege and read every credential stored in the…

• CVE-2026-20251HigJun 10, 2026
  Splunk

  Splunk
  risk 0.57cvss 8.8epss 0.32

  In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold…

• CVE-2024-53247HigDec 10, 2024
  Splunk

  Splunk Enterprise
  risk 0.57cvss 8.8epss 0.01

  In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.4.261 and 3.7.13 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could perform a Remote Code…

• CVE-2024-45733HigOct 14, 2024
  Splunk

  Splunk
  risk 0.57cvss 8.8epss 0.01

  In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration.

• CVE-2024-36984HigJul 1, 2024
  Splunk

  Splunk
  risk 0.57cvss 8.8epss 0.01

  In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code.

• CVE-2023-40595HigAug 30, 2023
  Splunk

  Splunk
  risk 0.57cvss 8.8epss 0.01

  In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code.

• CVE-2023-22932HigFeb 14, 2023
  Splunk

  Splunk
  risk 0.57cvss 8.7epss 0.00

  In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0.

• CVE-2022-43570HigNov 4, 2022
  Splunk

  Splunk
  risk 0.57cvss 8.8epss 0.01

  In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View. The XXE injection causes Splunk Web to embed incorrect documents into an error.

• CVE-2022-43567HigNov 4, 2022
  Splunk

  Splunk
  risk 0.57cvss 8.8epss 0.01

  In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app.

• CVE-2022-27183HigMay 6, 2022
  Splunk

  Splunk
  risk 0.57cvss 8.8epss 0.01

  The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on…

• CVE-2022-26889HigMay 6, 2022
  Splunk

  Splunk
  risk 0.57cvss 8.8epss 0.01

  In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page (e.g., HTML Injection, XSS) or bypass SPL safeguards for risky…

• CVE-2021-42743HigMay 6, 2022
  Splunk

  Splunk
  risk 0.57cvss 8.8epss 0.00

  A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows.

• CVE-2023-32712HigJun 1, 2023
  Splunk

  Splunk
  risk 0.56cvss 8.6epss 0.00

  In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files that, when a vulnerable terminal application reads them, can potentially, at worst, result in possible code…

• CVE-2023-40598HigAug 30, 2023
  Splunk

  Splunk
  risk 0.55cvss 8.5epss 0.01

  In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can…

• CVE-2023-40592HigAug 30, 2023
  Splunk

  Splunk
  risk 0.55cvss 8.4epss 0.01

  In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of…

• CVE-2026-76354HigAug 19, 2026
  Splunk

  Splunk Enterprise
  risk 0.53cvss 8.1epss 0.00

  In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could affect system integrity and availability by sending a crafted Representational State Transfer (REST) API request that deletes or temporarily…

• CVE-2026-76338HigAug 19, 2026
  Splunk

  Splunk Enterprise
  risk 0.53cvss 8.1epss 0.00

  In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service…