CVE-2026-20251

Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway

State: Published
Severity: 8.8 High
Published: Jun 10, 2026
Updated: Jun 11, 2026
Reserved: Oct 8, 2025

Description

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-502 The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	10.2 to before 10.2.4Affected 10.0 to before 10.0.7Affected 9.4 to before 9.4.12Affected 9.3 to before 9.3.13Affected
Splunk Cloud PlatformSplunk	10.3.2512 to before 10.3.2512.12Affected 10.2.2510 to before 10.2.2510.14Affected 10.1.2507 to before 10.1.2507.22Affected 9.3.2411 to before 9.3.2411.132Affected
Splunk Secure GatewaySplunk	3.10 to before 3.10.6Affected 3.9 to before 3.9.20Affected 3.8 to before 3.8.67Affected

References

https://advisory.splunk.com/advisories/SVD-2026-0601

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.