CVE-2026-20251

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2026-0601	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*

Configuration 2 (hide)

OR	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::

Configuration 3 (hide)

OR	cpe:2.3:a:splunk:splunk_secure_gateway::::::::
	cpe:2.3:a:splunk:splunk_secure_gateway::::::::
	cpe:2.3:a:splunk:splunk_secure_gateway::::::::

History

No history.

Information

Published : 2026-06-10 18:16

Updated : 2026-06-17 10:17

NVD link : CVE-2026-20251

Mitre link : CVE-2026-20251

CVE.ORG link : CVE-2026-20251

JSON object : View

Products Affected

splunk

splunk_cloud_platform
splunk
splunk_secure_gateway

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-20251", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20251", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-10T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.2", "lessThan": "10.2.4", "versionType": "custom"}, {"status": "affected", "version": "10.0", "lessThan": "10.0.7", "versionType": "custom"}, {"status": "affected", "version": "9.4", "lessThan": "9.4.12", "versionType": "custom"}, {"status": "affected", "version": "9.3", "lessThan": "9.3.13", "versionType": "custom"}]}, {"vendor": "Splunk", "product": "Splunk Cloud Platform", "versions": [{"status": "affected", "version": "10.3.2512", "lessThan": "10.3.2512.12", "versionType": "custom"}, {"status": "affected", "version": "10.2.2510", "lessThan": "10.2.2510.14", "versionType": "custom"}, {"status": "affected", "version": "10.1.2507", "lessThan": "10.1.2507.22", "versionType": "custom"}, {"status": "affected", "version": "9.3.2411", "lessThan": "9.3.2411.132", "versionType": "custom"}]}, {"vendor": "Splunk", "product": "Splunk Secure Gateway", "versions": [{"status": "affected", "version": "3.10", "lessThan": "3.10.6", "versionType": "custom"}, {"status": "affected", "version": "3.9", "lessThan": "3.9.20", "versionType": "custom"}, {"status": "affected", "version": "3.8", "lessThan": "3.8.67", "versionType": "custom"}]}]}], "published": "2026-06-10T18:16:40.477", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-0601", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the \u2018jsonpickle\u2019 Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation."}], "lastModified": "2026-06-17T10:17:19.723", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "B9D80F1C-F849-4D62-B82A-6B8963EEEBFB", "versionEndExcluding": "9.3.13", "versionStartIncluding": "9.3.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "423B8DF2-B7A5-41AA-9CFD-75B2FD503ACC", "versionEndExcluding": "9.4.12", "versionStartIncluding": "9.4.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "0C9F1DED-280E-4C76-A867-A7A8FCBD1F7A", "versionEndExcluding": "10.0.7", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "E3B992C0-AD5E-43A1-BAA3-6B11FFD5D750", "versionEndExcluding": "10.2.4", "versionStartIncluding": "10.2.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88A68C7C-BE2C-465C-812B-8F211A8AE935", "versionEndExcluding": "9.3.2411.132", "versionStartIncluding": "9.3.2411"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13BDF451-89BD-4E5B-8DCB-16BF9AE81FAC", "versionEndExcluding": "10.1.2507.22", "versionStartIncluding": "10.1.2507"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BE580133-150E-4007-989F-00491BF7A064", "versionEndExcluding": "10.2.2510.14", "versionStartIncluding": "10.2.2510"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D78DAE10-4B29-4B44-B09A-041500E22CEF", "versionEndExcluding": "10.3.2512.12", "versionStartIncluding": "10.3.2512"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9361838-B66C-4485-898F-6A3FFD401DEA", "versionEndExcluding": "3.8.67", "versionStartIncluding": "3.8.0"}, {"criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A2F72B2-2F09-4EA8-8AFB-D35FC5652117", "versionEndExcluding": "3.9.20", "versionStartIncluding": "3.9.0"}, {"criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25DD95BD-64E4-4DCC-BBD3-05CD8D168D50", "versionEndExcluding": "3.10.6", "versionStartIncluding": "3.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}