Published file metadata, source observations, indicators, and research history in one bounded catalog.
Splunk addressed multiple vulnerabilities in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. See CVE Details for vulnerability-specific information.
First reported Aug 19, 2026 00:00 UTCOpen evidence recordOn October 7, 2026, Splunk PSIRT will publish advisories to disclose security vulnerabilities for Splunk Enterprise and Splunk Apps and Add-ons.
First reported Sep 09, 2026 00:00 UTCOpen evidence recordIn Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the “admin” or “power” Splunk roles could cause the Splunk AI Toolkit to make outbound requests over HTTP to a server that an attacker controls, which could allow for data exfiltration. The vulnerability exists because of an insecure default domain allowlist in the Splunk AI Toolkit, which does not restrict outboun
First reported Jun 17, 2026 00:00 UTCOpen evidence recordIn Splunk AI Toolkit versions below 5.7.4, a user who holds the “admin” Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.
First reported Jun 17, 2026 00:00 UTCOpen evidence recordIn Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, and 9.3.2411.131, a user who holds a Splunk role that contains the high-privilege capability edit_saved_search_owner could reassign saved search ownership to users outside their authorized scope. The ownership reassignment endpoint lac
First reported Jun 10, 2026 00:00 UTCOpen evidence recordSplunk addressed multiple vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. See CVE Details for vulnerability-specific affected versions, additional remediation, acknowledgments, and workarounds.
First reported Oct 07, 2026 00:00 UTCOpen evidence recordSplunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk SOAR version 8.5.0, and higher.
First reported Jun 10, 2026 00:00 UTCOpen evidence recordSplunk addressed multiple vulnerabilities in Splunk SOAR Connectors. See CVE Details for vulnerability-specific and product-specific information.
First reported Aug 19, 2026 00:00 UTCOpen evidence recordIn Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the “admin” or “power” Splunk roles could craft a malicious classic dashboard that exfiltrates sensitive data to an external server. The vulnerability exists because URL validation on th
First reported Jun 10, 2026 00:00 UTCOpen evidence recordSplunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.
First reported Oct 07, 2026 00:00 UTCOpen evidence recordSplunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk SOAR version 8.6.0, and higher.
First reported Aug 19, 2026 00:00 UTCOpen evidence recordIn Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the “admin” or “power” Splunk roles could craft a classic dashboard that exfiltrates sensitive data from the browser of a higher-privileged user who views it. The exfiltration is possibl
First reported Jun 10, 2026 00:00 UTCOpen evidence recordSplunk remedied common vulnerabilities and exposures (CVEs) in third-party packages in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 or higher.
First reported Oct 07, 2026 00:00 UTCOpen evidence recordIn Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the “admin” or “power” Splunk roles could store a malicious script in a classic dashboard HTML panel, causing unauthorized JavaScript code to execute in the browser of another user. The
First reported Jun 10, 2026 00:00 UTCOpen evidence recordSplunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Universal Forwarder versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, and higher.
First reported Aug 19, 2026 00:00 UTCOpen evidence recordSplunk addressed multiple vulnerabilities in Splunk apps and add-ons. See CVE Details for vulnerability and product specific information.
First reported Aug 19, 2026 00:00 UTCOpen evidence recordSplunk addressed multiple vulnerabilities in Splunk SOAR 8.6.0. See CVE Details for vulnerability-specific information.
First reported Aug 19, 2026 00:00 UTCOpen evidence recordSplunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Python for Scientific Computing version 4.3.2 and higher.
First reported Jul 01, 2026 00:00 UTCOpen evidence recordSplunk addressed multiple vulnerabilities in Splunk Enterprise Security 8.6.1. See CVE Details for vulnerability-specific information.
First reported Aug 19, 2026 00:00 UTCOpen evidence recordSplunk remedied common vulnerabilities and exposures (CVEs) in third-party packages in Splunk Add-on for Amazon Web Services version 8.2.2 and higher.
First reported Oct 07, 2026 00:00 UTCOpen evidence recordSplunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 10.4.0, 10.2.4, 10.0.7, 9.4.12, 9.3.13, and higher.
First reported Jun 10, 2026 00:00 UTCOpen evidence recordSplunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Universal Forwarder versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, and higher.
First reported Jul 15, 2026 00:00 UTCOpen evidence recordIn Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the list_deployment_server capability into running arbitrary Search Processing Language (SPL) searches on their behalf as splunk-system-user, allowing for access
First reported Jul 15, 2026 00:00 UTCOpen evidence recordIn Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface (API) tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it to access data and perform actions as the user who ran the tool. Successful exploitation requires a us
First reported Oct 07, 2026 00:00 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.