Loading story…
Splunk Enterprise carried an absolute path traversal vulnerability in the runshellscript command, tracked as CVE-2023-40597, that affected versions earlier than 8.2.12, 9.0.6, and 9.1.1. The flaw could allow arbitrary code execution from a separate disk, giving an attacker a path to take control of a Splunk instance and potentially expand access to sensitive log data or other connected systems.
Splunk Threat Research published a hunting analytic to spot exploitation attempts by reviewing internal splunk_python logs for runshellscript executions with suspicious path characteristics and a specific argument count, though the detection was later removed after patched releases became current. If exploited, attackers could use the resulting access to perform common post-compromise discovery activity such as enumerating files and directories to locate data for collection, exfiltration, or destructive actions including encryption or wiping.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the 'Splunk Absolute Path Traversal Using runshellscript' hunting analytic from its content library in version 5.6.0 because the associated CVEs had been patched. The entry notes the detection is no longer maintained or supported.
Splunk Enterprise releases 8.2.12, 9.0.6, and 9.1.1 addressed CVE-2023-40597, an absolute path traversal issue involving runshellscript that could enable arbitrary code execution. The detection content states the associated CVEs were already patched in current releases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk issued urgent fixes for **CVE-2026-20253**, a critical `CVSS 9.8` vulnerability in **Splunk Enterprise** that allows unauthenticated arbitrary file creation and truncation through a PostgreSQL sidecar service endpoint missing authentication controls. The flaw affects supported Splunk Enterprise releases prior to **10.4.0**, **10.2.4**, **10.0.7**, **9.4.12**, and **9.3.13** depending on branch, and Splunk said **Splunk Cloud is not affected** because it does not use Postgres sidecars. Splunk and national cyber authorities urged administrators to apply updates immediately, noting that no vendor detections or workarounds were initially available for the core issue. Public technical analysis from watchTowr Labs showed the bug can be reached through Splunk Web on port `8000`, which proxies requests to localhost-only PostgreSQL recovery endpoints, enabling attackers to abuse `/v1/postgres/recovery/backup` and `/restore` for filesystem access. Researchers demonstrated a full pre-auth exploitation chain that used path traversal, PostgreSQL connection-string injection, local `.pgpass` credentials, and PostgreSQL large-object export to gain arbitrary file write as the `splunk` user, then overwrite a Splunk Python script to achieve remote code execution. Splunk also disclosed additional Enterprise flaws including **CVE-2026-20251** (`CVSS 8.8`) in the Splunk Secure Gateway app due to unsafe `jsonpickle` deserialization, plus stored XSS and SSRF issues, prompting guidance to patch quickly, restrict dashboard creation and web exposure, and disable or remove vulnerable components where immediate upgrades are not possible.
Jul 23, 2026
Splunk disclosed a high-severity **remote command execution (RCE)** vulnerability, **CVE-2026-20163** (CVSS **8.0**), affecting *Splunk Enterprise* and *Splunk Cloud Platform*. The issue is a **command injection** weakness (CWE-77) in the REST endpoint `/splunkd/__upload/indexing/preview`, where user-controlled input is insufficiently sanitized during the “uploaded file preview before indexing” workflow. Exploitation requires an authenticated user whose role includes the high-privilege capability `edit_cmd`; under that condition, an attacker can abuse the `unarchive_cmd` parameter to execute arbitrary shell commands on the underlying host. Reported affected versions include Splunk Enterprise **10.0.0–10.0.3**, **9.4.0–9.4.8**, and **9.3.0–9.3.9**, plus Splunk Cloud Platform versions below **10.2.2510.5**, **10.1.2507.16**, **10.0.2503.12**, and **9.3.2411.124**; fixed thresholds are Enterprise **10.0.4**, **9.4.9**, **9.3.10**, and **10.2.0** (with the base Enterprise **10.2** release noted as not affected). The disclosure credits researcher **Danylo Dmytriiev (DDV_UA)** along with Splunk personnel **Gabriel Nitu** and **James Ervin**.
Jun 29, 2026
Splunk disclosed **CVE-2026-20253**, a critical unauthenticated vulnerability in the PostgreSQL sidecar component of **Splunk Enterprise** and **Splunk Cloud Platform** that lets a network-reachable attacker create or truncate arbitrary files on the host. The flaw, tracked as **`VULN-67169`** and **`SVD-2026-0603`**, is rated **CVSS 9.8** and affects Splunk Enterprise `10.2.0` through `10.2.3` and `10.0.0` through `10.0.6`, as well as Splunk Cloud Platform versions below `10.4.2604.3` and below `10.2.2510.14`. Splunk said fixed versions are available, cloud instances are being actively patched, and no workaround exists other than upgrading. Splunk also published security content tied to **`SVD-2026-0603`** to help defenders simulate and validate detection of the exposed sidecar behavior, including replayable attack data mapped to **MITRE ATT&CK `T1210`**. Separately, the company disclosed **CVE-2026-20140**, a Windows-only local privilege-escalation flaw in Splunk Enterprise caused by DLL search-order hijacking during service startup; that issue can allow a low-privileged local user to gain **`NT AUTHORITY\SYSTEM`** privileges and has been fixed in supported branches, with Splunk advising upgrades, tighter write permissions, and monitoring for suspicious DLL drops and service restarts.
Jul 13, 2026