What is the CVSS score of CVE-2026-20251?

CVE-2026-20251 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Splunk Enterprise are affected by CVE-2026-20251?

Splunk Enterprise, Cloud Platform, and Secure Gateway contain a critical remote code execution vulnerability allowing any authenticated user-even those without administrative privileges-to execute…. A patch is available.

How to fix or mitigate CVE-2026-20251?

Within 24 hours: Identify all Splunk Enterprise, Splunk Cloud Platform, and Splunk Secure Gateway deployments; immediately restrict KV Store access permissions to administrative accounts only. Within 7 days: Contact Splunk directly for patch availability and timeline (SVD-2026-0601); implement network-level segmentation to isolate Splunk administrative interfaces. Within 30 days: Apply vendor patch immediately upon release; conduct full audit of KV Store data access logs for anomalies.

Splunk Enterprise CVE-2026-20251

EUVD-2026-36082 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-10 cisco

GHSA-3crw-7xg9-fpxg

Python Deserialization Splunk RCE Splunk Enterprise Splunk Cloud Platform Splunk Secure Gateway

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 10, 2026 - 20:01 EUVD

Analysis Generated

Jun 10, 2026 - 18:33 vuln.today

DescriptionNVD

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.

Articles & Coverage 2

News 7 New Python Vulnerabilities - 1 Critical, 6 High Severity Jun 11, 2026 News 6 New Python Vulnerabilities - 1 Critical, 5 High Severity Jun 10, 2026

AnalysisAI

Remote code execution in Splunk Enterprise, Splunk Cloud Platform, and the Splunk Secure Gateway app allows a low-privileged authenticated user (without 'admin' or 'power' roles) to execute arbitrary Python on the server by abusing unsafe jsonpickle deserialization of App Key Value Store (KV Store) data. CVSS is 8.8 (network, low complexity, low privileges) and the issue is currently rated as no public exploit identified at time of analysis. The flaw is reported by Cisco and disclosed via Splunk advisory SVD-2026-0601.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data) in the Splunk Secure Gateway app, which uses the Python jsonpickle library to reconstruct objects from JSON stored in Splunk's App KV Store. jsonpickle is documented as unsafe against untrusted input because its decoder will instantiate arbitrary Python classes and invoke __reduce__/__setstate__-style gadgets encoded in the JSON, enabling code execution at decode time. Affected components per the CPE data are splunk:splunk_enterprise, splunk:splunk_cloud_platform, and splunk:splunk_secure_gateway - the Secure Gateway app is the entry point but the vulnerable deserialization runs in the Splunk Python runtime that backs Enterprise and Cloud Platform deployments.

RemediationAI

Vendor-released patch: upgrade Splunk Enterprise to 10.2.4, 10.0.7, 9.4.12, or 9.3.13 (or later in each branch); Splunk Cloud Platform is being updated by Splunk to 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, or 9.3.2411.132; and update the Splunk Secure Gateway app to 3.10.6, 3.9.20, or 3.8.67 per https://advisory.splunk.com/advisories/SVD-2026-0601. If immediate patching is not possible, the most effective compensating control is to disable or uninstall the Splunk Secure Gateway app (this removes the vulnerable jsonpickle code path but breaks the Splunk Mobile / Connected Experiences and Spacebridge functionality that depends on it); as an additional control, restrict Splunkweb and KV Store API access to a trusted management network and tighten role assignments so that fewer authenticated users can reach the Secure Gateway endpoints, accepting that this does not eliminate insider risk.