# Multiple vulnerabilities in Splunk products

Published: 2026-06-11 · Severity: high
Canonical: https://vorant.io/reports/42e0bc5c-e475-5426-803f-33e2a87767e5/multiple-vulnerabilities-in-splunk-products

> Critical remote code execution and SSRF vulnerabilities across Splunk Cloud Platform, Enterprise, Secure Gateway and SOAR require immediate patching.

CERT-FR has published a security advisory documenting multiple vulnerabilities affecting several Splunk products released on 10 June 2026. The vulnerabilities span Splunk Cloud Platform (versions 9.3, 10.0, 10.1, 10.2, 10.3, 10.4), Splunk Enterprise (versions 9.3, 9.4, 10.0, 10.2), Splunk Secure Gateway (versions 3.8, 3.9, 3.10), and Splunk SOAR (versions prior to 8.5.0). The flaws enable remote code execution, data confidentiality breaches, server-side request forgery (SSRF), security policy bypasses, and indirect code injection (XSS).

The advisory references 40 CVEs across 12 separate Splunk security bulletins (SVD-2026-0601 through SVD-2026-0612). Affected organizations running any of the named Splunk products should immediately review the vendor's security advisories and apply the recommended patches to the specified fixed versions. The scope and number of vulnerabilities, particularly those enabling remote code execution and SSRF, warrant urgent remediation.

## Mentioned in this report

- Vulnerabilities: CVE-2025-12817, CVE-2025-12818, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, CVE-2025-61726, CVE-2025-61731, CVE-2025-61732, CVE-2025-68121, CVE-2025-68146, CVE-2025-68161, CVE-2025-8869, CVE-2026-1229, CVE-2026-1703, CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006, CVE-2026-20251, CVE-2026-20252, CVE-2026-20253 (KEV), CVE-2026-20254, CVE-2026-20255, CVE-2026-20256, CVE-2026-20257, CVE-2026-20258, CVE-2026-20259, CVE-2026-20260, CVE-2026-22701, CVE-2026-23490, CVE-2026-24049, CVE-2026-24051, CVE-2026-25679, CVE-2026-27142, CVE-2026-27448, CVE-2026-27459, CVE-2026-34477, CVE-2026-34480, CVE-2026-34516, CVE-2026-34520

## Detection guidance (public sample)

### Splunk Daemon Spawning Shell or Download/Recon Utilities on Windows

ATT&CK: T1190

splunkd.exe spawning PowerShell, cmd with download or recon tooling, or LOLBins, which may indicate exploitation of a Splunk RCE flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Splunk Daemon Spawning Shell or Download/Recon Utilities on Windows
description: Detects splunkd.exe spawning PowerShell, certutil, bitsadmin, whoami,
  net or similar utilities. This may indicate post-exploitation of a remote code execution
  flaw in Splunk Enterprise. Generalises on the parent/child relation, not on specific
  CVEs.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \splunkd.exe
  selection_child:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \curl.exe
    - \wmic.exe
  filter_splunk_scripts:
    CommandLine|contains: \Splunk\etc\apps\
  condition: selection_parent and selection_child and not filter_splunk_scripts
falsepositives:
- Splunk apps with scripted inputs that invoke PowerShell from a custom app directory
- Administrators running diagnostic scripts through Splunk alert actions
level: medium
id: b75dda22-c6ce-57bd-b3ad-5717dc85fee8
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0736
```

### Splunk Process Spawning Network Download or Reverse Shell Tooling on Linux

ATT&CK: T1190

splunkd spawning curl, wget, netcat, socat or /dev/tcp shells on Linux, which may indicate Splunk RCE or SSRF exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Splunk Process Spawning Network Download or Reverse Shell Tooling on Linux
description: Detects splunkd spawning curl, wget, netcat, socat or bash /dev/tcp redirections
  on Linux hosts. This may indicate post-exploitation of a remote code execution flaw
  in Splunk Enterprise.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /splunkd
  selection_tools:
    Image|endswith:
    - /curl
    - /wget
    - /nc
    - /ncat
    - /socat
  selection_revshell:
    CommandLine|contains: /dev/tcp/
  condition: selection_parent and (selection_tools or selection_revshell)
falsepositives:
- Custom Splunk scripted inputs or alert actions that call curl to post to internal
  webhooks
level: medium
id: ae43496d-6b0f-52b8-a0ea-61eaa48ba3dd
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0736
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0736

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/42e0bc5c-e475-5426-803f-33e2a87767e5/multiple-vulnerabilities-in-splunk-products.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup