Loading story…
Splunk released patches for three vulnerabilities affecting Splunk Enterprise, Splunk Cloud Platform, and the Splunk AI Toolkit, including a high-severity denial-of-service bug and two issues that can expose sensitive data. CVE-2026-20240 affects the splunk_archiver app, where a low-privileged user can abuse the coldToFrozen.sh script to rename critical directories and render an instance inoperable. CVE-2026-20239 stems from improper output sanitization in the TcpChannel component and can leak session cookies and cleartext HTTP response bodies into the _internal log index, while CVE-2026-20238 is an access-control weakness in the Splunk AI Toolkit that can bypass intended search restrictions and expose restricted data.
Splunk said the issues were fixed in updated releases, including AI Toolkit 5.7.3 for CVE-2026-20238, and urged customers to upgrade affected deployments. The company also published interim mitigations for organizations that cannot patch immediately, including restricting access to the _internal index to administrators, disabling the Splunk Archiver application, reviewing inherited roles and permissions, and removing the problematic srchFilter entry from local configuration where applicable. The advisories highlight risks to both platform availability and the confidentiality of operational data stored in Splunk environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-25606, a SQL injection flaw in STER, was recorded as a newly received vulnerability by cvd@cert.pl. The entry noted that the issue allows authenticated attackers to access sensitive data and that the vendor fixed it in STER version 9.5.
Splunk disclosed and patched CVE-2026-20238, CVE-2026-20239, and CVE-2026-20240 affecting Splunk AI Toolkit, Splunk Enterprise, and Splunk Cloud Platform. The flaws could expose restricted data, leak sensitive information into internal logs, or allow a low-privileged user to trigger denial-of-service conditions, and Splunk issued upgrade and mitigation guidance.
CERT Polska published details of three vulnerabilities affecting STER versions before 9.5: SQL injection (CVE-2026-25606), weak password encoding (CVE-2026-25607), and cleartext transmission over unencrypted TCP (CVE-2026-25608). The disclosure credited Michelin CERT for the report and stated the issues were fixed in STER version 9.5.
Splunk published vulnerability advisory SVD-2026-0302. Based on the available metadata, this represents a separate Splunk disclosure event distinct from the earlier SVD-2026-0201 advisory and the later May 2026 multi-CVE disclosure.
Splunk published vulnerability advisory SVD-2026-0201. Based on the reference metadata, this advisory represents an earlier Splunk disclosure event preceding the later May 2026 vulnerability reporting already in the timeline.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourceadvisory.splunk.com
Open sourceadvisory.splunk.com
Open sourcecert.pl
Open sourceadvisory.splunk.com
Open sourceadvisory.splunk.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk released security updates for **Splunk Enterprise**, **Splunk Cloud Platform**, and **Splunk Secure Gateway** to address eight vulnerabilities, including two high-severity issues. The most serious flaw, **`CVE-2025-20229`**, can allow authenticated remote code execution through unauthorized file upload and execution, while **`CVE-2025-20231`** can expose sensitive data because session data and authentication tokens may be logged in plaintext and protected with improper permissions. Splunk documentation for managing app and add-on objects is relevant because the attack surface includes application components and uploaded objects within Splunk environments. The update also fixes several medium-severity weaknesses, including **CSRF**, an **SPL security bypass with command execution**, unauthorized access to sensitive data, and unauthorized system changes. Splunk further remediated vulnerabilities in bundled third-party components including **idna**, **certifi**, **requests**, **urllib3**, **cryptography**, **axios**, and **Jinja2**. Organizations using affected versions have been urged to upgrade promptly, and exposure from **`CVE-2025-20231`** can also be reduced by disabling the **Splunk Secure Gateway App** until patches are applied.
Jul 24, 2026
Splunk released security updates for multiple vulnerabilities in **Splunk Enterprise** and **Splunk Cloud Platform**, led by **`CVE-2026-20296`**, a high-severity flaw in the Deployment Server component of Splunk Web. The bug combines missing CSRF validation on `GET` requests with improper neutralization of user-controlled input, allowing an attacker to trick a user with the `list_deployment_server` capability into triggering arbitrary SPL searches as `splunk-system-user`. Successful exploitation could expose indexed data and stored credentials, with additional integrity and limited availability impact. The update also addresses **`CVE-2026-20297`** in the App Install REST endpoint and **`CVE-2026-20298`** in the `storage/passwords` REST endpoint, which could enable path traversal and disclosure of stored credential hashes. Splunk published patched versions and mitigation guidance for customers, while **Splunk Cloud Platform** instances are being patched and monitored by Splunk. **Splunk Enterprise** administrators were advised to upgrade promptly and apply a configuration change to reduce exposure from the credential-hash disclosure issue.
Jul 17, 2026
Splunk disclosed a critical vulnerability in **Splunk AI Toolkit** that allows OS command injection through the `btool` Configuration Helper, affecting versions earlier than **5.7.4**. Tracked as **`CVE-2026-20266`** and rated **CVSS 9.1**, the flaw stems from unsafe shell execution that can let a user with the Splunk **admin** role run arbitrary commands on the host running Splunk Enterprise, creating a direct path to host compromise. Splunk also fixed **`CVE-2026-20265`**, a lower-severity insecure default domain allowlist issue rated **CVSS 4.3** that could allow a low-privileged user to trigger outbound HTTP requests and potentially exfiltrate data to an attacker-controlled server. The Canadian Centre for Cyber Security highlighted the vendor advisory in **AV26-614** and urged administrators to review Splunk’s guidance and upgrade to **version 5.7.4 or later**; public reporting said there was **no confirmed exploitation in the wild** at disclosure time.
Jul 12, 2026