Vulnerability · Published Jun 10, 2026 · Assigned by cisco

CVE-2026-20259Improper Access Control in Splunk Enterprise

Medium 5.5

In plain English

A medium-severity improper access control in Splunk Cloud Platform from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.2%top 91.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, and 9.3.2411.131, a user who holds a Splunk role that contains the high-privilege capability `edit_saved_search_owner` could reassign saved search ownership to users outside their authorized scope. The ownership reassignment endpoint lacks access control.

Affected products (as reported)

Vendor	Product	Versions
Splunk	Splunk Enterprise	10.2 – before 10.2.410.0 – before 10.0.7
Splunk	Splunk Cloud Platform	10.3.2512 – before 10.3.2512.1210.2.2510 – before 10.2.2510.1510.1.2507 – before 10.1.2507.2310.0.2503 – before 10.0.2503.149.3.2411 – before 9.3.2411.131

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

References

https://advisory.splunk.com/advisories/SVD-2026-0609