PT-2026-48491 · Splunk+1 · Splunk Enterprise+3

Published

2026-06-10

·

Updated

2026-06-11

·

CVE-2026-20251

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.4 Splunk Enterprise versions prior to 10.0.7 Splunk Enterprise versions prior to 9.4.12 Splunk Enterprise versions prior to 9.3.13 Splunk Cloud Platform versions prior to 10.3.2512.12 Splunk Cloud Platform versions prior to 10.2.2510.14 Splunk Cloud Platform versions prior to 10.1.2507.22 Splunk Cloud Platform versions prior to 9.3.2411.132 Splunk Secure Gateway versions prior to 3.10.6 Splunk Secure Gateway versions prior to 3.9.20 Splunk Secure Gateway versions prior to 3.8.67
Description A low-privileged user without 'admin' or 'power' roles can achieve Remote Code Execution (RCE) through the Splunk Secure Gateway app. This is caused by unsafe deserialization of App Key Value Store (KV Store) data using the jsonpickle Python library, which allows the reconstruction of arbitrary Python objects from specially crafted JSON without sufficient validation.
Recommendations Update Splunk Enterprise to versions 10.2.4, 10.0.7, 9.4.12, or 9.3.13 depending on the current release track. Update Splunk Cloud Platform to versions 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, or 9.3.2411.132 depending on the current release track. Update Splunk Secure Gateway to versions 3.10.6, 3.9.20, or 3.8.67 depending on the current release track.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-20251

Affected Products

Splunk Cloud Platform
Splunk Enterprise
Splunk Secure Gateway App
Jsonpickle