Loading story…
Splunk disclosed and patched multiple vulnerabilities affecting Splunk Enterprise, Splunk Cloud Platform, and the MCP Server application, including two high-severity issues in its core platforms. The most serious, CVE-2026-20204, could allow a low-privileged user to achieve remote code execution by uploading a malicious file into the temporary application directory at $SPLUNK_HOME/var/run/splunk/apptemp, a weakness tied to improper temporary-file handling and insufficient isolation. Italian authorities also warned that newly identified flaws in Splunk products could expose sensitive information and allow arbitrary file writes on affected systems, urging organizations to review impacted version branches and apply vendor fixes.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
A security notice reported newly identified vulnerabilities in Splunk Enterprise and Splunk Cloud Platform, including two high-severity issues involving arbitrary file write and information disclosure. Organizations were urged to update affected versions according to Splunk security bulletins.
Splunk disclosed and patched multiple vulnerabilities affecting Splunk Enterprise, Splunk Cloud Platform, and the MCP Server application. The fixes included CVE-2026-20204, which could let a low-privileged user achieve remote code execution, and CVE-2026-20205, which could expose sessions and authorization tokens in clear text; Splunk advised upgrades and noted Cloud Platform updates were being applied directly.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk released security updates for **Splunk Enterprise**, **Splunk Cloud Platform**, and **Splunk Secure Gateway** to address eight vulnerabilities, including two high-severity issues. The most serious flaw, **`CVE-2025-20229`**, can allow authenticated remote code execution through unauthorized file upload and execution, while **`CVE-2025-20231`** can expose sensitive data because session data and authentication tokens may be logged in plaintext and protected with improper permissions. Splunk documentation for managing app and add-on objects is relevant because the attack surface includes application components and uploaded objects within Splunk environments. The update also fixes several medium-severity weaknesses, including **CSRF**, an **SPL security bypass with command execution**, unauthorized access to sensitive data, and unauthorized system changes. Splunk further remediated vulnerabilities in bundled third-party components including **idna**, **certifi**, **requests**, **urllib3**, **cryptography**, **axios**, and **Jinja2**. Organizations using affected versions have been urged to upgrade promptly, and exposure from **`CVE-2025-20231`** can also be reduced by disabling the **Splunk Secure Gateway App** until patches are applied.
Jul 24, 2026
Splunk has disclosed six critical security vulnerabilities affecting both Splunk Enterprise and Splunk Cloud Platform, exposing organizations to significant risks. The vulnerabilities include multiple cross-site scripting (XSS) flaws, an unauthenticated server-side request forgery (SSRF) vulnerability, and other weaknesses in Splunk’s web components. Two of the most notable XSS vulnerabilities are CVE-2025-20367, a reflected XSS in the /app/search/table endpoint, and CVE-2025-20368, a stored XSS in the Saved Search and Job Inspector features. Both XSS flaws can be exploited by low-privileged users to execute malicious JavaScript in the browsers of other users, potentially compromising user sessions and exposing sensitive data. The SSRF vulnerability, CVE-2025-20371, is particularly severe as it allows unauthenticated attackers to coerce Splunk into making REST API calls on behalf of authenticated high-privilege users, which could lead to further compromise of internal systems. These vulnerabilities affect multiple versions of Splunk Enterprise, specifically those below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, as well as various versions of Splunk Cloud Platform. Successful exploitation of these flaws could allow attackers to gain unauthorized access, escalate privileges, and perform actions on behalf of legitimate users. Splunk has released patches addressing all six vulnerabilities and urges administrators to update their deployments immediately to mitigate the risks. The vulnerabilities highlight the importance of regular security assessments and prompt patch management in enterprise environments. Organizations using affected Splunk versions are advised to review their access logs for signs of exploitation and to apply the security updates without delay. The disclosure underscores the potential impact of web-based vulnerabilities in widely used security and analytics platforms. Security teams should also consider reviewing user permissions and monitoring for unusual activity in Splunk environments. The coordinated disclosure and rapid patching demonstrate the ongoing efforts by vendors and the security community to address critical flaws. These vulnerabilities, if left unpatched, could be leveraged in targeted attacks against organizations relying on Splunk for security monitoring and data analytics. The incident serves as a reminder of the evolving threat landscape and the need for vigilance in securing enterprise software. Splunk’s response includes detailed advisories and guidance for affected customers. The company has not reported any active exploitation in the wild at the time of disclosure, but the technical details provided could accelerate attempts by threat actors to develop exploits. Organizations are encouraged to stay informed about security advisories and to implement layered defenses to reduce the risk of compromise.
Jun 29, 2026
Splunk released patches for three vulnerabilities affecting **Splunk Enterprise**, **Splunk Cloud Platform**, and the **Splunk AI Toolkit**, including a high-severity denial-of-service bug and two issues that can expose sensitive data. `CVE-2026-20240` affects the `splunk_archiver` app, where a low-privileged user can abuse the `coldToFrozen.sh` script to rename critical directories and render an instance inoperable. `CVE-2026-20239` stems from improper output sanitization in the TcpChannel component and can leak session cookies and cleartext HTTP response bodies into the `_internal` log index, while `CVE-2026-20238` is an access-control weakness in the Splunk AI Toolkit that can bypass intended search restrictions and expose restricted data. Splunk said the issues were fixed in updated releases, including **AI Toolkit 5.7.3** for `CVE-2026-20238`, and urged customers to upgrade affected deployments. The company also published interim mitigations for organizations that cannot patch immediately, including restricting access to the `_internal` index to administrators, disabling the **Splunk Archiver** application, reviewing inherited roles and permissions, and removing the problematic `srchFilter` entry from local configuration where applicable. The advisories highlight risks to both platform availability and the confidentiality of operational data stored in Splunk environments.
Jun 29, 2026