Loading story…
Splunk disclosed that Splunk Enterprise deployment servers before version 9.0 allowed unauthenticated downloading of forwarder bundles, a weakness tracked as CVE-2022-32157. The issue could expose sensitive configuration data contained in deployment bundles and potentially aid follow-on activity such as lateral movement, while Splunk Cloud Platform was not affected because it does not use deployment servers. Splunk said Universal Forwarders were not directly vulnerable, but customers needed to upgrade both deployment servers and managed forwarders to version 9.0 or later and enable authentication between servers and clients to fully remediate the risk.
Splunk later published a hunting analytic designed to detect suspicious bundle downloads through PackageDownloadRestHandler logs, helping defenders identify cases where unauthorized clients may have retrieved deployment content. That detection has since been removed and deprecated from Splunk Threat Research content because the associated vulnerabilities were patched in current releases, and Splunk said it had no evidence of external exploitation at the time of disclosure. The company noted that impact varies with the sensitivity of the bundle contents, ranging from informational to medium severity in lower-risk environments.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Splunk removed the hunting detection "Splunk Process Injection Forwarder Bundle Downloads" from its Threat Research content library in version 5.6.0, stating it is no longer maintained or supported. Splunk said the detection was deprecated because the associated CVEs, including CVE-2022-32157, had been patched in the latest Splunk release.
On 2022-07-18, Splunk's SVD-2022-0607 advisory changelog says it added Components in the Product Status table, Severity Considerations, and acknowledgments for Paul Schultze and Martin Müller. The advisory covers a flaw in Splunk Enterprise deployment servers before 9.0 that allows unauthenticated downloading of forwarder bundles.
A Splunk security_content workbook file named splunk_psa_0622.json was published in the referenced GitHub repository. The reference provides no further event details beyond the file's publication.
Splunk disclosed that Splunk Enterprise deployment servers before version 9.0 permit unauthenticated forwarder bundle downloads and identified Splunk Enterprise 9.0.0 as the fixed version. Splunk instructed customers to upgrade deployment servers and managed Universal Forwarders to 9.0 or later and enable authentication between deployment servers and clients.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourcesplunk.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk has disclosed two high-severity vulnerabilities, CVE-2025-20386 and CVE-2025-20387, affecting its Enterprise and Universal Forwarder products on Windows platforms. These flaws arise from incorrect NTFS file permissions set during installation and upgrades, allowing non-administrator users to access, modify, or overwrite sensitive files within the Splunk installation directories. The vulnerabilities enable local privilege escalation, potentially allowing attackers or compromised users to gain administrative access, alter configurations, or execute malicious code under elevated privileges. No active exploitation has been reported, but the risk remains significant for unpatched systems. The vulnerabilities impact both new installations and upgrades, with affected directories containing executable binaries, configuration files, and scripts critical to Splunk's operation. Attackers with local access could replace binaries, modify configuration files, inject malicious startup scripts, or hijack supporting executables, leading to full system compromise. Splunk has released patched versions (10.0.2, 9.4.6, 9.3.8, and 9.2.10) and strongly advises customers to upgrade immediately to mitigate these risks and prevent potential privilege escalation attacks.
Jun 29, 2026
Splunk has disclosed six critical security vulnerabilities affecting both Splunk Enterprise and Splunk Cloud Platform, exposing organizations to significant risks. The vulnerabilities include multiple cross-site scripting (XSS) flaws, an unauthenticated server-side request forgery (SSRF) vulnerability, and other weaknesses in Splunk’s web components. Two of the most notable XSS vulnerabilities are CVE-2025-20367, a reflected XSS in the /app/search/table endpoint, and CVE-2025-20368, a stored XSS in the Saved Search and Job Inspector features. Both XSS flaws can be exploited by low-privileged users to execute malicious JavaScript in the browsers of other users, potentially compromising user sessions and exposing sensitive data. The SSRF vulnerability, CVE-2025-20371, is particularly severe as it allows unauthenticated attackers to coerce Splunk into making REST API calls on behalf of authenticated high-privilege users, which could lead to further compromise of internal systems. These vulnerabilities affect multiple versions of Splunk Enterprise, specifically those below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, as well as various versions of Splunk Cloud Platform. Successful exploitation of these flaws could allow attackers to gain unauthorized access, escalate privileges, and perform actions on behalf of legitimate users. Splunk has released patches addressing all six vulnerabilities and urges administrators to update their deployments immediately to mitigate the risks. The vulnerabilities highlight the importance of regular security assessments and prompt patch management in enterprise environments. Organizations using affected Splunk versions are advised to review their access logs for signs of exploitation and to apply the security updates without delay. The disclosure underscores the potential impact of web-based vulnerabilities in widely used security and analytics platforms. Security teams should also consider reviewing user permissions and monitoring for unusual activity in Splunk environments. The coordinated disclosure and rapid patching demonstrate the ongoing efforts by vendors and the security community to address critical flaws. These vulnerabilities, if left unpatched, could be leveraged in targeted attacks against organizations relying on Splunk for security monitoring and data analytics. The incident serves as a reminder of the evolving threat landscape and the need for vigilance in securing enterprise software. Splunk’s response includes detailed advisories and guidance for affected customers. The company has not reported any active exploitation in the wild at the time of disclosure, but the technical details provided could accelerate attempts by threat actors to develop exploits. Organizations are encouraged to stay informed about security advisories and to implement layered defenses to reduce the risk of compromise.
Jun 29, 2026
Splunk released security updates for multiple vulnerabilities in **Splunk Enterprise** and **Splunk Cloud Platform**, led by **`CVE-2026-20296`**, a high-severity flaw in the Deployment Server component of Splunk Web. The bug combines missing CSRF validation on `GET` requests with improper neutralization of user-controlled input, allowing an attacker to trick a user with the `list_deployment_server` capability into triggering arbitrary SPL searches as `splunk-system-user`. Successful exploitation could expose indexed data and stored credentials, with additional integrity and limited availability impact. The update also addresses **`CVE-2026-20297`** in the App Install REST endpoint and **`CVE-2026-20298`** in the `storage/passwords` REST endpoint, which could enable path traversal and disclosure of stored credential hashes. Splunk published patched versions and mitigation guidance for customers, while **Splunk Cloud Platform** instances are being patched and monitored by Splunk. **Splunk Enterprise** administrators were advised to upgrade promptly and apply a configuration change to reduce exposure from the credential-hash disclosure issue.
Jul 17, 2026