Loading story…
Splunk documented and later removed a detection for attempts to abuse a cross-site request forgery vulnerability, tracked as CVE-2024-45737, to change KVStore maintenance mode in Splunk Enterprise and Splunk Cloud Platform. The issue allowed low-privileged users without admin or power roles to alter KVStore state in affected releases, including Splunk Enterprise versions earlier than 9.3.1, 9.2.3, and 9.1.6, and Splunk Cloud Platform versions earlier than 9.2.2403.108, 9.1.2312.204, and 9.1.2308.211.
The activity was mapped to MITRE ATT&CK T1489 Service Stop, a technique commonly used by ransomware and destructive malware to terminate or disable services, security tools, backups, databases, and virtualization processes in order to increase operational impact and hinder recovery. MITRE’s catalog shows the technique is widely used by families including Conti, LockBit, Ryuk, and BlackCat, as well as disruptive malware such as HermeticWiper and KillDisk; Splunk said the related detection was removed from its Threat Research library after the underlying vulnerabilities were patched in current releases.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the detection "Splunk Disable KVStore via CSRF Enabling Maintenance Mode" from its content library in version 5.6.0 because the associated CVEs had been patched in current releases. The detection update date is listed as 2026-05-14.
Splunk patched the CVEs associated with a cross-site request forgery issue that could let a low-privileged user change App Key Value Store maintenance mode. The issue affected multiple Splunk Enterprise and Splunk Cloud Platform versions and is referenced as CVE-2024-45737 and advisory SVD-2024-1007.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk disclosed **CVE-2026-20253**, a critical unauthenticated vulnerability in the PostgreSQL sidecar component of **Splunk Enterprise** and **Splunk Cloud Platform** that lets a network-reachable attacker create or truncate arbitrary files on the host. The flaw, tracked as **`VULN-67169`** and **`SVD-2026-0603`**, is rated **CVSS 9.8** and affects Splunk Enterprise `10.2.0` through `10.2.3` and `10.0.0` through `10.0.6`, as well as Splunk Cloud Platform versions below `10.4.2604.3` and below `10.2.2510.14`. Splunk said fixed versions are available, cloud instances are being actively patched, and no workaround exists other than upgrading. Splunk also published security content tied to **`SVD-2026-0603`** to help defenders simulate and validate detection of the exposed sidecar behavior, including replayable attack data mapped to **MITRE ATT&CK `T1210`**. Separately, the company disclosed **CVE-2026-20140**, a Windows-only local privilege-escalation flaw in Splunk Enterprise caused by DLL search-order hijacking during service startup; that issue can allow a low-privileged local user to gain **`NT AUTHORITY\SYSTEM`** privileges and has been fixed in supported branches, with Splunk advising upgrades, tighter write permissions, and monitoring for suspicious DLL drops and service restarts.
Jul 13, 2026
Splunk documented and later removed a detection for privilege escalation in which low-privilege users could abuse the `edit_user` capability to obtain administrative access. The analytic monitored `_audit` logs for password-related actions including `change_own_password`, `password_change`, and `edit_password` when access was granted to accounts that were not administrators or system users, and warned that successful exploitation could result in full control of the Splunk environment and potential data exposure. The detection was mapped to MITRE ATT&CK technique **T1548: Abuse Elevation Control Mechanism**, which covers privilege escalation and defense evasion through misuse of built-in control mechanisms across platforms. Splunk marked the analytic as deprecated and removed it after the underlying issue, tracked as **`CVE-2023-32707`**, was patched in current releases, noting the detection had been disabled by default, required access to the `_audit` index, and could produce false positives during legitimate password changes.
Aug 12, 2026
Splunk removed two security analytics tied to `CVE-2022-32151` after stating the underlying issues were patched in current releases. The retired detections had been designed to flag Splunk forwarder connections where `ssl=false` and to identify weak TLS certificate-validation settings in Python `httplib` and `urllib` components across search heads and peers. Splunk warned that these conditions could expose sensitive data, allow interception or manipulation of traffic, and in some cases enable attackers to download or publish forwarder bundles, creating a path to arbitrary code execution. The risks align with the broader ATT&CK technique **T1001.003: Protocol or Service Impersonation**, which covers malware and intrusion sets that disguise command-and-control traffic as legitimate services or protocols such as TLS and HTTP. MITRE documents how adversaries use fake TLS handshakes, spoofed record headers, and benign-looking HTTP headers, cookies, URI parameters, and POST bodies to evade inspection. In Splunk environments, weak or absent encryption can make that kind of impersonation harder to distinguish from normal traffic, which is why the detections had focused on missing encryption and certificate-validation weaknesses before being deprecated in version `5.6.0`.
Aug 12, 2026