EUVD-2026-36082
GHSA-3crw-7xg9-fpxg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.
AnalysisAI
Remote code execution in Splunk Enterprise, Splunk Cloud Platform, and the Splunk Secure Gateway app allows a low-privileged authenticated user (without 'admin' or 'power' roles) to execute arbitrary Python on the server by abusing unsafe jsonpickle deserialization of App Key Value Store (KV Store) data. CVSS is 8.8 (network, low complexity, low privileges) and the issue is currently rated as no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated Splunk session for a user that does NOT need to hold the 'admin' or 'power' roles (per CVSS PR:L and the description), no user interaction, and network reachability to a Splunk instance with the Splunk Secure Gateway app installed and enabled - Secure Gateway is shipped by default with recent Splunk Enterprise/Cloud builds, so this is the common case. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-reachable, low-complexity exploitation by an authenticated low-privileged user with full CIA impact, which aligns with the description of a non-admin/non-power Splunk user achieving RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained any low-privileged Splunk account - for example via phishing a routine analyst, reused credentials, or a compromised SSO session - authenticates to Splunkweb and submits a crafted JSON document to a Secure Gateway KV Store endpoint. When the Secure Gateway app reads that document back through jsonpickle, the embedded gadget chain instantiates arbitrary Python objects and executes attacker-controlled code in the Splunk process, giving full read/write access to indexed data, saved searches, and the underlying host. |
| Remediation | Vendor-released patch: upgrade Splunk Enterprise to 10.2.4, 10.0.7, 9.4.12, or 9.3.13 (or later in each branch); Splunk Cloud Platform is being updated by Splunk to 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, or 9.3.2411.132; and update the Splunk Secure Gateway app to 3.10.6, 3.9.20, or 3.8.67 per https://advisory.splunk.com/advisories/SVD-2026-0601. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Splunk Enterprise, Splunk Cloud Platform, and Splunk Secure Gateway deployments; immediately restrict KV Store access permissions to administrative accounts only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated server-side request forgery in Tautulli versions prior to 2.17.1 allows remote attackers to coerce the T
Path traversal in NASA AMMOS AIT-Core's Binary Stream Capture (BSC) component allows unauthenticated remote attackers to
Authentication bypass in dhax/go-base Go REST API boilerplate (versions prior to commit cc82b974, merged May 17, 2026) a
Remote code execution in Tautulli versions prior to 2.17.1 allows attackers to achieve unauthenticated RCE on fresh inst
Stored cross-site scripting in Tautulli before 2.17.1 allows low-privilege authenticated users (including guests when gu
Share
External POC / Exploit Code
Leaving vuln.today