Vulnerability · Published Jun 10, 2026 · Assigned by cisco
CVE-2026-20251Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway
High 8.8
In plain English
A high-severity unsafe deserialization in Splunk Cloud Platform from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 30.6% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 10.2 – before 10.2.410.0 – before 10.0.79.4 – before 9.4.129.3 – before 9.3.13 |
| Splunk | Splunk Cloud Platform | 10.3.2512 – before 10.3.2512.1210.2.2510 – before 10.2.2510.1410.1.2507 – before 10.1.2507.229.3.2411 – before 9.3.2411.132 |
| Splunk | Splunk Secure Gateway | 3.10 – before 3.10.63.9 – before 3.9.203.8 – before 3.8.67 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H