VulnSocial

CVE-2026-20296Patch(splunk / splunk)

LOWCVSS 8.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch splunk splunk systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment_server` capability into running arbitrary Search Processing Language (SPL) searches on their behalf as `splunk-system-user`, allowing for access to stored credentials and indexed data.<br><br>The vulnerability is possible because Deployment Server endpoints in Splunk Web do not validate Cross-Site Request Forgery (CSRF) tokens on GET requests, and caller-supplied input is not correctly neutralized before it is placed into an SPL search.

splunk CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-352

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • splunk
  • splunk_cloud_platform

Threat summary

  • Patch or workaround signal is available
  • 9 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 7 signals
  • Technical details provided in 7 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 6 mentions (2026-07-16); latest day: 1
  • 9 total mentions across 3 days

Affected systems

Vendors
splunk
Products
splunksplunk_cloud_platform

1 version affected across 2 products

Deep dive

Activity timeline9 mentions / 3d
02356Mentions · 2026-07-15: 2Mentions · 2026-07-16: 6Mentions · 2026-07-23: 1Patch / Workaround · 2026-07-16: 6Patch / Workaround · 2026-07-23: 1Technical Details · 2026-07-15: 1Technical Details · 2026-07-16: 5Technical Details · 2026-07-23: 107-1507-1607-23
Signal classification2 categories
Patch
777.8%
Disclosure
222.2%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-07-152
Disclosure2
2026-07-166
Patch6
2026-07-231
Patch1
Full discourse9 posts
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Splunk patched three Splunk Enterprise vulnerabilities: CVE-2026-20296 CSRF, CVE-2026-20297 path traversal, and CVE-2026-20298 credential exposure. #Splunk #CVE202620296 #CSRF #Vulnerability #InfoSec http://securityonline.info/splunk-enterprise-vulnerabilities-cve-2026-20296/

    Post summary

    The tweet announces that Splunk Enterprise has released patches for three CVEs involving CSRF, path traversal, and credential exposure, and provides a link for further details.

    02021409
    12.9K followersView on X
  • CCB Alert@CCBalert
    Patch

    Warning: #Splunk has released patches for critical vulnerabilities in Splunk Enterprise, including a #CSRF flaw (CVE-2026-20296, CVSS 8.3) allowing privileged SPL execution, and a path traversal bug (CVE-2026-20297, CVSS 7.2). https://advisory.splunk.com/ #Patch #Patch #Patch

    Post summary

    Splunk has released patches for two critical CVEs (CVE-2026-20296 and CVE-2026-20297) involving CSRF and path traversal, with no exploit details or active exploitation reported.

    02010284
    7.2K followersView on X
  • kokumօtօ@__kokumoto
    Patch

    Splunk Enterpriseで3件の脆弱性が修正。最も深刻なのはCVSSスコア8.3のCSRF脆弱性CVE-2026-20296。splunk-system-userとして任意SPLを実行可能。 https://securityonline.info/splunk-enterprise-vulnerabilities-cve-2026-20296/

    Post summary

    The post announces that Splunk Enterprise has issued patches for three vulnerabilities, notably CVE-2026-20296—a CVSS 8.3 CSRF flaw allowing arbitrary SPL execution as splunk‑system‑user.

    00020758
    7.7K followersView on X
  • iototsecnews@iototsecnews
    Patch

    Splunk の脆弱性 CVE-2026-20296／20297／20298 が FIX：パストラバーサルや認証情報漏洩の恐れ https://iototsecnews.jp/2026/07/16/multiple-splunk-enterprise-vulnerabilities-enable-path-traversal-and-information-disclosure-attacks/ 大規模なログ管理やデータ分析に欠かせない統合プラットフォーム Splunk Enterprise に、重要コンポーネントに影響を及ぼす複数の欠陥が見つかりました。システムへ集約される機密情報が高価値な標的になりやすく、管理機能の隙が狙われやすいという背景があります。今回の脆弱性 CVE-2026-20296 などが悪用されると、フィッシング経由の遠隔操作で任意の検索を実行され、保存されたパスワードのハッシュが窃取される恐れがあります。対応策として、開発元から配布されている最新の修正済みバージョンへ速やかにアップグレードし、設定ファイルの変更による緩和策も適用する必要があります。 #CVE202620296 #CVE202620297 #CVE202620298 #Splunk #Vulnerability

    Post summary

    The article reports path‑traversal and credential‑disclosure vulnerabilities (CVE‑2026‑20296/297/298) in Splunk Enterprise and urges users to upgrade to the latest patched release.

    01000171
    501 followersView on X
  • The Daily Tech Feed@dailytechonx
    Patch

    Splunk has patched critical vulnerabilities in its Enterprise and Cloud Platform, including CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298. Users should update to versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, or later to mitigate these security risks. #Splunk #CyberSecurity #Vulnerability #SecurityUpdate #CVE202620296 #CVE202620297 #CVE202620298 https://thedailytechfeed.com/splunk-patches-critical-vulnerabilities-in-enterprise-platform/

    Post summary

    Splunk released patches for CVE‑2026‑20296/97/98 and advises users to upgrade to the specified versions to mitigate the risks.

    0000060
    539 followersView on X
  • TECHEPAGES@techepages
    Patch

    ⚠️ Splunk just patched three vulnerabilities in Splunk Enterprise & Cloud Platform — the worst (CVE-2026-20296, CVSS 8.3) lets attackers run arbitrary SPL searches as splunk-system-user via a phishing link, potentially exposing indexed data and stored credentials. What to know: 🔹 Upgrade to 10.4.1 / 10.2.5 / 10.0.8 / 9.4.13+ 🔹 Path traversal flaw (CVE-2026-20297) can write files outside app directories 🔹 Low-priv users could pull credential hashes via the REST endpoint 🔹 Quick wins: set mask_encr_password = true & disable Splunk Web where unused

    Post summary

    Splunk has released patches for three CVEs, providing specific upgrade versions and quick mitigations for the identified vulnerabilities.

    0000038
    23 followersView on X
  • キタきつね@foxbook
    Patch

    SplunkがCVE-2026-20296 CSRF脆弱性を含む3つのSplunk Enterpriseの脆弱性を修正 Splunk Fixes Three Splunk Enterprise Vulnerabilities Led by CVE-2026-20296 CSRF Flaw #DailyCyberSecurity (Jul 16) https://securityonline.info/splunk-enterprise-vulnerabilities-cve-2026-20296/

    Post summary

    Splunk released a patch to address three Enterprise vulnerabilities, including the CSRF flaw CVE-2026-20296, with no indication of active exploitation or need for a PoC.

    00000260
    4.9K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-20296 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18,… https://www.cve.org/CVERecord?id=CVE-2026-20296 ----- Traducción: CVE-2026-20296 En … http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2026-20296, listing affected Splunk software versions, but gives no PoC, exploit, or mitigation details.

    0000038
    92 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-20296 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18,… https://www.cve.org/CVERecord?id=CVE-2026-20296

    Post summary

    The post notes CVE‑2026‑20296 affects specific Splunk Enterprise and Cloud Platform versions and links to the CVE record, but offers no exploitation details, mitigations, or technical description.

    00000934
    57.8K followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appsplunksplunk---
Appsplunksplunk10.4.0--
Appsplunksplunk_cloud_platform---

Explore more

Back to dashboardsplunk CVEssplunk vulnerabilities