← Back

CVE-2026-20251

nvd nist
Published: Jun 10, 2026Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: psirt@cisco.com (Secondary)

Description

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.

Affected (11)

Splunk
3 products
Splunk
Splunk Cloud Platform
Splunk Secure Gateway
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Splunk
Splunk
From 10.0.0 to 10.0.7
Splunk
From 10.2.0 to 10.2.4
Splunk
From 9.3.0 to 9.3.13
Splunk
From 9.4.0 to 9.4.12
Configuration B
4 vulnerable
Vulnerable SoftwareAffected Versions
Splunk
Splunk Cloud Platform
From 10.1.2507 to 10.1.2507.22
Splunk Cloud Platform
From 10.2.2510 to 10.2.2510.14
Splunk Cloud Platform
From 10.3.2512 to 10.3.2512.12
Splunk Cloud Platform
From 9.3.2411 to 9.3.2411.132
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Splunk
Splunk Secure Gateway
From 3.10.0 to 3.10.6
Splunk Secure Gateway
From 3.8.0 to 3.8.67
Splunk Secure Gateway
From 3.9.0 to 3.9.20

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (1)

Source: psirt@cisco.com
Vendor Advisory

Timeline

No history available yet.