CVE-2026-20251

HIGH

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

Title source: cna
STIX 2.1

Description

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.

References (1)

Core 1

Scores

CVSS v3 8.8
EPSS 0.0056
EPSS Percentile 42.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-502
Status published
Products (14)
splunk/splunk 9.3.0 - 9.3.13
Splunk/Splunk Cloud Platform 10.1.2507 - 10.1.2507.22
Splunk/Splunk Cloud Platform 10.2.2510 - 10.2.2510.14
Splunk/Splunk Cloud Platform 10.3.2512 - 10.3.2512.12
Splunk/Splunk Cloud Platform 9.3.2411 - 9.3.2411.132
Splunk/Splunk Enterprise 10.0 - 10.0.7
Splunk/Splunk Enterprise 10.2 - 10.2.4
Splunk/Splunk Enterprise 9.3 - 9.3.13
Splunk/Splunk Enterprise 9.4 - 9.4.12
Splunk/Splunk Secure Gateway 3.10 - 3.10.6
... and 4 more
Published Jun 10, 2026
Tracked Since Jun 11, 2026