Vulnerability

CERT-In Vulnerability Note CIVN-2026-0334
Multiple Vulnerabilities in Splunk Products

Original Issue Date:June 24, 2026

Severity Rating: CRITICAL

Software Affected

Splunk AI Toolkit versions prior to 5.7.4

Overview

Multiple vulnerabilities have been reported in Splunk products, which could allow a remote attacker to execute arbitrary OS commands and make outbounds requests over HTTP to an attacker-controlled server.

Target Audience:
All organizations and individuals using Splunk products.

Risk Assessment:
Potential for unauthorized access to sensitive information and data exfiltration.

Impact Assessment:
High risk of information disclosure, privilege misuse, and compromise of confidentiality and integrity.

Description

Splunk is a platform used for searching, monitoring, and analyzing machine-generated data in real time. It collects, indexes, and correlates large volumes of data generated by applications, servers, networks, and other infrastructure components.

These vulnerabilities exist in Splunk products due to unsafe shell execution pattern in the btool configuration helper, which constructs operating system command strings from dynamic parameters without disabling shell interpretation and insecure default domain allowlist in the Splunk AI Toolkit, which does not restrict outbound AI agent requests to approved external domains.

Successful exploitation of these vulnerabilities could allow a user with the Splunk "admin" role to execute arbitrary commands and a low-privileged user that does not hold the Splunk "admin" or "power" roles could make outbound request to attacker-controlled servers, which could allow for data exfiltration from the targeted system.

Solution

Apply appropriate updates as mentioned by the vendor:
https://advisory.splunk.com/advisories/SVD-2026-0613

https://advisory.splunk.com/advisories/SVD-2026-0614

Vendor Information

Splunk
https://advisory.splunk.com/advisories/SVD-2026-0613
https://advisory.splunk.com/advisories/SVD-2026-0614

References

Splunk
https://advisory.splunk.com/advisories/SVD-2026-0613
https://advisory.splunk.com/advisories/SVD-2026-0614

CVE Name
CVE-2026-20265
CVE-2026-20266

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India