Vulnerability

CERT-In Vulnerability Note CIVN-2026-0202
Multiple Vulnerabilities in Splunk Enterprise Products

Original Issue Date:April 23, 2026

Severity Rating: HIGH

Software Affected

Splunk Enterprise (Splunk Web) prior to version 10.2.1
Splunk Enterprise (REST API) prior to version 10.2.2
Splunk Enterprise (Splunk Web & REST API) prior to version 10.0.5
Splunk Enterprise (Splunk Web & REST API) prior to version 9.4.10
Splunk Enterprise (Splunk Web & REST API) prior to version 9.3.11
Splunk Cloud Platform (Splunk Web) prior to version 10.3.2512.5
Splunk Cloud Platform (REST API) prior to version 10.3.2512.6
Splunk Cloud Platform (Splunk Web) prior to version 10.2.2510.9
Splunk Cloud Platform (REST API) prior to version 10.2.2510.10
Splunk Cloud Platform (Splunk Web) prior to version 10.1.2507.19
Splunk Cloud Platform (REST API) prior to version 10.1.2507.20
Splunk Cloud Platform (Splunk Web & REST API) prior to version 10.0.2503.13
Splunk Cloud Platform (Splunk Web & REST API) prior to version 9.3.2411.127
Splunk MCP Server prior to version 1.0.3

Overview

Multiple vulnerabilities have been reported in Splunk products which could be exploited by an attacker to execute arbitrary code, gain access to sensitive information, or perform unauthorized actions on the targeted system.

Target Audience:
Organizations and individuals using Splunk Enterprise, Splunk Cloud Platform, and Splunk MCP Server.

Risk Assessment:
Potential for complete system compromise.

Impact Assessment:
High risk of information disclosure, privilege misuse, and full system compromise.

Description

Splunk is a data analytics platform that collects, indexes, and analyzes machine-generated data to enable real-time monitoring, security insights, and operational intelligence.

Multiple vulnerabilities have been reported in Splunk products due to improper access control, improper input validation, insecure handling of temporary files, and exposure of sensitive information in logs. An attacker could exploit these vulnerabilities by sending specially crafted requests to the targeted system.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, gain access to sensitive information, or perform unauthorized actions on the targeted system.

Solution

Apply appropriate fixes issued by the vendor:
https://advisory.splunk.com/advisories/SVD-2026-0401

https://advisory.splunk.com/advisories/SVD-2026-0402

https://advisory.splunk.com/advisories/SVD-2026-0403

https://advisory.splunk.com/advisories/SVD-2026-0407

Vendor Information

Splunk
https://advisory.splunk.com/

References

Splunk
https://advisory.splunk.com/advisories/SVD-2026-0401
https://advisory.splunk.com/advisories/SVD-2026-0402
https://advisory.splunk.com/advisories/SVD-2026-0403
https://advisory.splunk.com/advisories/SVD-2026-0407

CVE Name
CVE-2026-20202
CVE-2026-20203
CVE-2026-20204
CVE-2026-20205

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India