Splunk products affected by multiple remote code execution vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Splunk Enterprise, SOAR, and multiple apps patched for dozens of flaws enabling RCE, privilege escalation, and data theft.
CERT-FR has issued an advisory covering multiple vulnerabilities across Splunk's product portfolio, published August 19, 2026. The affected products span Splunk Enterprise (versions 9.4.x, 10.0.x, 10.2.x, 10.4.x), Splunk SOAR, Splunk Universal Forwarder, Enterprise Security, and numerous third-party integration apps including AWS IAM, Azure AD Graph, Cisco Webex, CrowdStrike OAuth, and others. The vulnerabilities enable remote code execution, privilege escalation, data confidentiality compromise, SQL injection, cross-site scripting (XSS), server-side request forgery (SSRF), CSRF attacks, and policy bypass. Organizations running any affected Splunk component must prioritize patching to specified versions. The advisory references eight separate Splunk security bulletins (SVD-2026-0801 through SVD-2026-0808) covering the fixes.
Mentioned in this report
Detection guidance
Splunkd Spawning Interpreters or Download/Recon Utilities on Windows
Detects splunkd.exe spawning PowerShell, script hosts, LOLBins or recon tools, a post-exploitation pattern after RCE in a Splunk component. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Splunkd Spawning Interpreters or Download/Recon Utilities on Windows
description: Detects splunkd.exe directly spawning PowerShell, script hosts, download
LOLBins or reconnaissance utilities. This is a likely post-exploitation pattern
after remote code execution in Splunk Enterprise or a Splunk app. Generalises on
the parent/child relation, not on any specific payload.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \splunkd.exe
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \mshta.exe
- \wscript.exe
- \cscript.exe
- \certutil.exe
- \bitsadmin.exe
- \whoami.exe
- \net.exe
- \net1.exe
- \nltest.exe
condition: selection
falsepositives:
- Custom Splunk scripted inputs or alert actions that invoke PowerShell or whoami
directly
- Admin troubleshooting that launches utilities through Splunk's runshellscript
level: medium
id: 9b03be16-f260-5551-8f3d-d23b97384eae
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1056
Splunkd Spawning Shell With Download or Reverse Shell Commands on Linux
Detects splunkd spawning a Unix shell whose command line downloads content or opens a reverse shell, indicating RCE exploitation of Splunk. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Splunkd Spawning Shell With Download or Reverse Shell Commands on Linux
description: Detects the splunkd process launching sh/bash with command-line content
typical of payload staging or reverse shells (curl, wget, /dev/tcp, nc, base64 decode).
Indicates possible exploitation of an RCE vulnerability in Splunk Enterprise or
a Splunk app.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /splunkd
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- /dev/tcp/
- nc -e
- ncat
- base64 -d
- mkfifo
condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Splunk scripted inputs that legitimately use curl or wget to poll internal APIs
- Admin-maintained alert actions that download files via a shell wrapper
level: high
id: 75747bb0-850b-55e9-9baa-1db1f5fc2d58
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1056
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1056
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs