CVE-2026-20251

HIGH

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-20251. PoCs published by reactivezero.

AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2026-20251, demonstrating a jsonpickle deserialization vulnerability in Splunk Secure Gateway. The PoC bypasses a validator function and executes arbitrary code via a py/reduce gadget, confirming remote code execution on a local research instance.

Description

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.

Exploits (1)

github WORKING POC 1 stars

by reactivezero · pythonpoc

https://github.com/reactivezero/CVE-2026-20251

View Code ZIP pw:eip

This repository contains a functional proof-of-concept exploit for CVE-2026-20251, demonstrating a jsonpickle deserialization vulnerability in Splunk Secure Gateway. The PoC bypasses a validator function and executes arbitrary code via a py/reduce gadget, confirming remote code execution on a local research instance.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Splunk Secure Gateway 3.9.19 / Splunk Enterprise 10.0.6

Auth required

Prerequisites: Low-privileged Splunk login · Access to write to the mobile_alerts KV Store collection

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Jun 27, 2026 Full analysis →

References (1)

Core 1

Core References

https://advisory.splunk.com/advisories/SVD-2026-0601

Scores

CVSS v3 8.8

EPSS 0.1899

EPSS Percentile 97.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-502

Status published

Products (14)

splunk/splunk 9.3.0 - 9.3.13

Splunk/Splunk Cloud Platform 10.1.2507 - 10.1.2507.22

Splunk/Splunk Cloud Platform 10.2.2510 - 10.2.2510.14

Splunk/Splunk Cloud Platform 10.3.2512 - 10.3.2512.12

Splunk/Splunk Cloud Platform 9.3.2411 - 9.3.2411.132

Splunk/Splunk Enterprise 10.0 - 10.0.7

Splunk/Splunk Enterprise 10.2 - 10.2.4

Splunk/Splunk Enterprise 9.3 - 9.3.13

Splunk/Splunk Enterprise 9.4 - 9.4.12

Splunk/Splunk Secure Gateway 3.10 - 3.10.6

... and 4 more

Published Jun 10, 2026

Tracked Since Jun 11, 2026