CVE-2026-20137Active Exploitation(splunk / splunk)

LOWCVSS 5.7 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for splunk splunk systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

In Splunk Enterprise versions below 10.2.0, 10.0.3, 9.4.5, 9.3.7, and 9.2.9, and Splunk Cloud Platform versions below 10.1.2507.0, 10.0.2503.9, 9.3.2411.112, and 9.3.2408.122, a low-privileged user who does not hold the "admin" or "power" Splunk roles could bypass the SPL safeguards for risky commands when they create a Data Model that contains an injected SPL query within an object. They can bypass the safeguards by exploiting a path traversal vulnerability.

splunk CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://advisory.splunk.com/advisories/SVD-2026-0202

Weakness type (CWE)

CWE-200CWE-22

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

splunk
splunk_cloud_platform

Threat summary

Active exploitation appears in 1 classified signals
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Affected systems

Vendors

splunk

Products

splunksplunk_cloud_platform

1 version affected across 2 products

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Referenced assets1 URL

By indicator

https://intel.threadlinqs.com/#TL-2026-0376

Full discourse1 post

ThreadLinqs@threadlinqs175d
Active Exploitation
NEW THREAT INTEL: Cisco Webex CVE-2026-20137 (CVSS 9.1) - Improper cert validation enables unauth MITM, decrypt, and tamper of cloud meeting traffic. 9 detections, 16 IOCs. https://intel.threadlinqs.com/#TL-2026-0376 #ThreatIntel #CyberSecurity #Cisco #Webex https://t.co/WiGB98zLpV
Post summary
Threat intel confirms Cisco Webex CVE-2026-20137 is being exploited in the wild, as evidenced by detections and IOCs, though no PoC or exploit code is shared.
0000089
23 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	splunk	splunk	-	-	-
App	splunk	splunk_cloud_platform	-	-	-
App	splunk	splunk_cloud_platform	10.1.2507	-	-

Explore more

Back to dashboard splunk CVEs splunk vulnerabilities