Multiple vulnerabilities in Splunk products
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Critical remote code execution and SSRF vulnerabilities across Splunk Cloud Platform, Enterprise, Secure Gateway and SOAR require immediate patching.
CERT-FR has published a security advisory documenting multiple vulnerabilities affecting several Splunk products released on 10 June 2026. The vulnerabilities span Splunk Cloud Platform (versions 9.3, 10.0, 10.1, 10.2, 10.3, 10.4), Splunk Enterprise (versions 9.3, 9.4, 10.0, 10.2), Splunk Secure Gateway (versions 3.8, 3.9, 3.10), and Splunk SOAR (versions prior to 8.5.0). The flaws enable remote code execution, data confidentiality breaches, server-side request forgery (SSRF), security policy bypasses, and indirect code injection (XSS).
The advisory references 40 CVEs across 12 separate Splunk security bulletins (SVD-2026-0601 through SVD-2026-0612). Affected organizations running any of the named Splunk products should immediately review the vendor's security advisories and apply the recommended patches to the specified fixed versions. The scope and number of vulnerabilities, particularly those enabling remote code execution and SSRF, warrant urgent remediation.
Mentioned in this report
Detection guidance
Splunk Daemon Spawning Shell or Download/Recon Utilities on Windows
splunkd.exe spawning PowerShell, cmd with download or recon tooling, or LOLBins, which may indicate exploitation of a Splunk RCE flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Splunk Daemon Spawning Shell or Download/Recon Utilities on Windows
description: Detects splunkd.exe spawning PowerShell, certutil, bitsadmin, whoami,
net or similar utilities. This may indicate post-exploitation of a remote code execution
flaw in Splunk Enterprise. Generalises on the parent/child relation, not on specific
CVEs.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \splunkd.exe
selection_child:
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
- \whoami.exe
- \net.exe
- \net1.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \curl.exe
- \wmic.exe
filter_splunk_scripts:
CommandLine|contains: \Splunk\etc\apps\
condition: selection_parent and selection_child and not filter_splunk_scripts
falsepositives:
- Splunk apps with scripted inputs that invoke PowerShell from a custom app directory
- Administrators running diagnostic scripts through Splunk alert actions
level: medium
id: b75dda22-c6ce-57bd-b3ad-5717dc85fee8
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0736
Splunk Process Spawning Network Download or Reverse Shell Tooling on Linux
splunkd spawning curl, wget, netcat, socat or /dev/tcp shells on Linux, which may indicate Splunk RCE or SSRF exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Splunk Process Spawning Network Download or Reverse Shell Tooling on Linux
description: Detects splunkd spawning curl, wget, netcat, socat or bash /dev/tcp redirections
on Linux hosts. This may indicate post-exploitation of a remote code execution flaw
in Splunk Enterprise.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /splunkd
selection_tools:
Image|endswith:
- /curl
- /wget
- /nc
- /ncat
- /socat
selection_revshell:
CommandLine|contains: /dev/tcp/
condition: selection_parent and (selection_tools or selection_revshell)
falsepositives:
- Custom Splunk scripted inputs or alert actions that call curl to post to internal
webhooks
level: medium
id: ae43496d-6b0f-52b8-a0ea-61eaa48ba3dd
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0736
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0736
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs