Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-11 | 3 | Disclosure2Patch1 |
| 2026-06-14 | 1 | PoC1 |
| 2026-06-27 | 1 | PoC1 |
| 2026-06-29 | 1 | PoC1 |
| 2026-07-03 | 1 | General1 |
| 2026-07-06 | 1 | PoC1 |
| 2026-07-08 | 1 | General1 |
| 2026-07-26 | 2 | Disclosure2 |
| 2026-07-27 | 1 | Patch1 |
‼️ CVE-2026-20251: Splunk Secure Gateway jsonpickle Deserialization RCE CVSS: 8.8 Published: June 26th, 2026 PoC: https://github.com/reactivezero/CVE-2026-20251 https://t.co/MMXcQ3ip5B
Post summary
The post announces CVE‑2026‑20251—a high‑severity RCE in Splunk Secure Gateway due to jsonpickle deserialization—and provides a GitHub PoC.
A CVSS 9.8 flaw highlights new Splunk Enterprise vulnerabilities. Patch CVE-2026-20253, CVE-2026-20251, and others to prevent remote attacks on your servers. #Splunk #Cybersecurity #Vulnerability #CVE2026_20253 #InfoSec https://securityonline.info/splunk-enterprise-vulnerabilities-cvss-9-8/ https://t.co/QESmhwfDVE
Post summary
The tweet highlights high-severity Splunk Enterprise vulnerabilities (CVSS 9.8) and strongly recommends applying the listed patches to mitigate potential remote attacks.
CVE-2026-20251: RCE στο Splunk Secure Gateway (CVSS 8.8) – τι να κάνετε τώρα https://secn.ws/3WfaGs
Post summary
The article announces a high‑severity RCE vulnerability (CVE-2026-20251) in Splunk Secure Gateway, providing its CVSS score and prompting users to take action.
Splunk Secure Gateway の RCE 脆弱性 CVE-2026-20251：PoC エクスプロイトが公開 https://iototsecnews.jp/2026/06/29/public-poc-released-for-deserialization-rce-vulnerability-in-splunk-secure-gateway/ 今回の脆弱性 CVE-2026-20251 は、プログラムの検証ロジックとデータ処理の仕組みに問題の原因があります。 データを復元する機能で、危険なタグを完全に防げていないことに加え、不審なデータをチェックする機能が最初の要素だけを見て安全だと誤認してしまう構造になっていました。 この 2 つの不備が重なった結果、攻撃者が用意した不正なコマンドが検査をすり抜けてそのまま実行されてしまいます。 低権限のアカウントであってもシステム内で任意のコードが動かせてしまうため、影響が大きくなっています。 ご利用のチームは、ご注意ください。 #CVE202620251 #PoC #SecureGateway #Splunk #Vulnerability
Post summary
A Proof‑of‑Concept exploit for the Splunk Secure Gateway RCE vulnerability (CVE‑2026‑20251) has been publicly released, offering attackers detailed information to exploit the flaw even from low‑privilege accounts.
Warning: Splunk has released multiple high and critical vulnerabilities in Splunk Enterprise. CVE-2026-20253 (CVSS 9.8) allows an unauthenticated attacker to create or truncate arbitrary files. CVE-2026-20251 (CVSS 8.8) could allow a low-privileged user to perform #RCE! #Patch
Post summary
A warning about two high‑severity CVEs in Splunk Enterprise, detailing CVSS scores and potential impacts, with a hint that a patch is available but without specifying exploitation or PoC.
🚨 CVE-2026-20251: RCE in Splunk Secure Gateway (CVSS 8.8). A low-privileged user can trigger unsafe deserialization via jsonpickle in KV Store data to achieve remote code execution—no user interaction required. Affects Splunk Enterprise 9.3–10.2.x and Splunk Cloud. Patch now (10.4.0/10.2.4/10.0.7/9.4.12/9.3.13+) or disable the app as a stopgap.
Post summary
CVE-2026-20251 is a remote code execution flaw in Splunk Secure Gateway affecting multiple versions; vendors have issued patches, and disabling the app is a workaround.
CVE-2026-20251: RCE στο Splunk Secure Gateway (CVSS 8.8) – τι να κάνετε τώρα https://secn.ws/SedUEJ
Post summary
The text announces CVE-2026-20251 as an RCE in Splunk Secure Gateway with a CVSS score of 8.8, but offers no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-20251: Splunk Secure Gateway Deserialization Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04nVZcq0
Post summary
The provided text is a brief blog or article title referencing CVE‑2026‑20251, offering an overview of its impact and suggested responses, but it lacks concrete technical or exploit details.
⚠️ Vulnerabilidades en productos Splunk ❗ CVE-2026-20253 ❗ CVE-2026-20252 ❗ CVE-2026-20251 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-splunk-6/ https://t.co/Qr17pq0lUL
Post summary
The post enumerates three Splunk CVE identifiers and links to external sites for additional information, but it provides no details on exploitation, patches, or proofs of concept.
A critical RCE vulnerability (CVE-2026-20251) in Splunk Secure Gateway allows low-privileged users to execute arbitrary code. A public PoC has been released, highlighting the urgency for organizations to upgrade to patched versions immediately. This flaw underscores the importance of secure coding practices, especially in deserialization processes. #Splunk #CyberSecurity #RCE #Vulnerability #Splunk #CyberSecurity #RCE #Vulnerability #Deserialization #SecurityUpdate https://thedailytechfeed.com/critical-rce-vulnerability-in-splunk-secure-gateway-exploited-via-public-poc/
Post summary
A public PoC for a critical RCE in Splunk Secure Gateway (CVE-2026-20251) has been released, prompting a call for immediate patching.
🚨 UPDATE — Splunk CVE-2026-20253: A public PoC is now on GitHub. No confirmed exploitation yet — but that window is closing fast. Critical detail many admins are missing: the PostgreSQL sidecar is active by default on Splunk Enterprise deployed on AWS — making cloud deployments exposed out of the box. Also confirmed: a second high-severity RCE (CVE-2026-20251, CVSS 8.8) in the same patch batch hits the Splunk Secure Gateway via unsafe Python deserialization — low-privileged user, no admin needed. Patch to 10.0.7, 10.2.4, 9.4.12, or 9.3.13. Don't wait. 👇 https://thehackernews.com/2026/06/critical-splunk-enterprise-flaw-lets.html
Post summary
A public PoC for Splunk CVE-2026-20253 has been released on GitHub, with no confirmed exploitation yet, but exposing PostgreSQL sidecar and a second high‑severity RCE (CVE-2026-20251) is highlighted—patches are available for multiple versions.
Splunk reported that CVE-2026-20251 enables low-privileged users to achieve remote code execution via the Splunk Secure Gateway app in Splunk Enterprise below 10.2.4 and Splunk Cloud Platform below 10.3.2512.12, according to its advisory. https://threatcluster.io/cluster/remote-code-execution-vulnerability-in-splunk-secure-gateway-08990014
Post summary
Splunk’s advisory confirms that CVE-2026-20251 allows remote code execution for low‑privileged users via the Secure Gateway app in older Splunk Enterprise and Cloud Platform versions, with no PoC, exploit, or active exploitation reported, nor are patches or mitigations provided.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | splunk | splunk | - | - | - |
| App | splunk | splunk_cloud_platform | - | - | - |
| App | splunk | splunk_secure_gateway | - | - | - |