Security Hardening in Splunk Enterprise - October 2026

Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise

Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise

Improper Control of a Resource Through its Lifetime in Splunk Enterprise

Improper Authorization through the REST API in Splunk Enterprise

Server-Side Request Forgery (SSRF) through the Report Notification REST API in Splunk Secure Gateway

Improper Privilege Management through PDF Attachments for Email Alert Actions in Splunk Enterprise

Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise

Remote Code Execution (RCE) through Federated Search in Splunk Enterprise

Path Traversal through the Lookup Configuration REST API in Splunk Enterprise

Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise

Code Injection through Splunk Web Manager Configuration in Splunk Enterprise

Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise

Remote Code Execution (RCE) through the REST API in Splunk Enterprise

SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise

Privilege Escalation through Scheduled Search Alert Action Configuration in Splunk Enterprise

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway app

Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows

Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise

Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows

Command Injection using External Lookups

Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature

Risky command safeguards bypass via ‘tstats command JSON in Splunk Enterprise

Risky command safeguards bypass via rex search command field names in Splunk Enterprise

Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise

Path Traversal through Search Head Clustering in Splunk Enterprise

Improper Authentication through REST API Distributed Search Token Requests in Splunk Enterprise

SPL Injection through the REST API in Splunk Enterprise

Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint

Risky command safeguards bypass in Dashboard Examples Hub

SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise

Remote Code Execution through file upload to “$SPLUNK_HOME/var/run/splunk/apptemp“ directory in Splunk Enterprise

Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk

Risky command safeguards bypass via Search ID query in Analytics Workspace in Splunk Enterprise

Improper Privilege Management on the Management Port in Splunk Enterprise for Windows

Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprise

Path Traversal through the Search Dispatch REST API in Splunk Enterprise

Protection Mechanism Failure in Splunk Enterprise

Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise

Denial of Service (DoS) through Unauthenticated Package Downloads over the REST API in Splunk Enterprise

Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise

Unauthenticated Information Disclosure through an Edge Processor Service Endpoint in Splunk Enterprise

Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise

Sensitive Information Disclosure through SPL commands

Denial of Service through null pointer reference in “cluster/config” REST endpoint

Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows

Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise