# Splunk products affected by multiple remote code execution vulnerabilities

Published: 2026-08-20 · Severity: high · Sectors: technology, financial-services, government-national, healthcare, energy
Canonical: https://vorant.io/reports/9160226a-e4a4-5b68-9fb0-793d06e80682/splunk-products-affected-by-multiple-remote-code-execution-vulnerabilities

> Splunk Enterprise, SOAR, and multiple apps patched for dozens of flaws enabling RCE, privilege escalation, and data theft.

CERT-FR has issued an advisory covering multiple vulnerabilities across Splunk's product portfolio, published August 19, 2026. The affected products span Splunk Enterprise (versions 9.4.x, 10.0.x, 10.2.x, 10.4.x), Splunk SOAR, Splunk Universal Forwarder, Enterprise Security, and numerous third-party integration apps including AWS IAM, Azure AD Graph, Cisco Webex, CrowdStrike OAuth, and others. The vulnerabilities enable remote code execution, privilege escalation, data confidentiality compromise, SQL injection, cross-site scripting (XSS), server-side request forgery (SSRF), CSRF attacks, and policy bypass. Organizations running any affected Splunk component must prioritize patching to specified versions. The advisory references eight separate Splunk security bulletins (SVD-2026-0801 through SVD-2026-0808) covering the fixes.

## Mentioned in this report

- Vulnerabilities: CVE-2024-35255, CVE-2025-13465, CVE-2025-13473, CVE-2025-14017, CVE-2025-14550, CVE-2025-14819, CVE-2025-15599, CVE-2025-53859, CVE-2025-6545, CVE-2025-6547, CVE-2025-66221, CVE-2025-67724, CVE-2025-67725, CVE-2025-67726, CVE-2025-68428, CVE-2025-69873, CVE-2026-0540, CVE-2026-1207 (templated), CVE-2026-1285, CVE-2026-1287, CVE-2026-1312, CVE-2026-1642, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006, CVE-2026-21226, CVE-2026-21860, CVE-2026-22702, CVE-2026-22815, CVE-2026-2391, CVE-2026-24001, CVE-2026-24040, CVE-2026-24043, CVE-2026-24133, CVE-2026-24737, CVE-2026-25535, CVE-2026-25673, CVE-2026-25674, CVE-2026-25679, CVE-2026-25755

## Detection guidance (public sample)

### Splunkd Spawning Interpreters or Download/Recon Utilities on Windows

ATT&CK: T1190

Detects splunkd.exe spawning PowerShell, script hosts, LOLBins or recon tools, a post-exploitation pattern after RCE in a Splunk component. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Splunkd Spawning Interpreters or Download/Recon Utilities on Windows
description: Detects splunkd.exe directly spawning PowerShell, script hosts, download
  LOLBins or reconnaissance utilities. This is a likely post-exploitation pattern
  after remote code execution in Splunk Enterprise or a Splunk app. Generalises on
  the parent/child relation, not on any specific payload.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \splunkd.exe
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
    - \nltest.exe
  condition: selection
falsepositives:
- Custom Splunk scripted inputs or alert actions that invoke PowerShell or whoami
  directly
- Admin troubleshooting that launches utilities through Splunk's runshellscript
level: medium
id: 9b03be16-f260-5551-8f3d-d23b97384eae
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1056
```

### Splunkd Spawning Shell With Download or Reverse Shell Commands on Linux

ATT&CK: T1059

Detects splunkd spawning a Unix shell whose command line downloads content or opens a reverse shell, indicating RCE exploitation of Splunk. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Splunkd Spawning Shell With Download or Reverse Shell Commands on Linux
description: Detects the splunkd process launching sh/bash with command-line content
  typical of payload staging or reverse shells (curl, wget, /dev/tcp, nc, base64 decode).
  Indicates possible exploitation of an RCE vulnerability in Splunk Enterprise or
  a Splunk app.
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /splunkd
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - nc -e
    - ncat
    - base64 -d
    - mkfifo
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Splunk scripted inputs that legitimately use curl or wget to poll internal APIs
- Admin-maintained alert actions that download files via a shell wrapper
level: high
id: 75747bb0-850b-55e9-9baa-1db1f5fc2d58
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1056
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1056

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9160226a-e4a4-5b68-9fb0-793d06e80682/splunk-products-affected-by-multiple-remote-code-execution-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup