CVE-2026-20251
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, as well as Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user without 'admin' or 'power' roles can perform Remote Code Execution (RCE) through the Splunk Secure Gateway app. This issue arises from unsafe deserialization of App Key Value Store (KV Store) data using the 'jsonpickle' library.
Risk Assessment
The organization may be exposed to remote code execution by unauthorized users, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade to the latest versions of Splunk that address this vulnerability and to implement appropriate access controls to limit user privileges.
Related vulnerabilities
- CVE-2026-86167Critical
A vulnerability was identified in Tenda HG10 (version 300001138) in the formgponConf function of the /boaform/admin/formgponConf file in the Boa component. Manipulation of the fmgpon_loid argument leads to OS command injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-86165Critical
A vulnerability was found in Tenda HG10 (version 300001138) in the formURL function of the /boaform/admin/formURL file. Manipulation of the Keywd/urlFQDN arguments results in a buffer overflow. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-86218Critical
N-central is vulnerable to pre-auth remote code execution. This issue affects N-central before version 2026.3.1.14.
- CVE-2026-75816Critical
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to and including 3.29.12. The pre_update_value function lacks capability or ownership checks, and ActionPost::conditions_logic() short-circuits the current_user_can('edit_post') authorization gate when the post ID is non-numeric, allowing unauthenticated form submissions to be routed to arbitrary user records. This enables unauthenticated attackers to overwrite any user's email address, including an administrator's, and then use WordPress's native password-reset flow to take over the account.
- CVE-2026-16310Critical
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.8.5 via the 'id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification to the victim.
- CVE-2026-86153Critical
A vulnerability has been found in Tenda CP3 (version 27.5.57.101) in the CRedirServer::SetRedirectEnable function of the Functions/Redirect.cpp file. The manipulation leads to improper privilege management. Remote exploitation is possible.
- CVE-2026-86152Critical
A flaw has been found in Tenda CP3 (version 27.5.57.101) in the CAutoAddWifi::ThreadProc function of the Functions/AutoAddWifi.cpp file in the Kylin component. Executing a manipulation can lead to OS command injection. The attack may be launched remotely.
- CVE-2026-86151Critical
A vulnerability was detected in Tenda CP3 (version 27.5.57.101) in the sub_2F77E8 function of the Apis/system.c file in the Network Configuration Management component. Performing a manipulation results in OS command injection. The attack may be initiated remotely.
- CVE-2026-86149Critical
A vulnerability has been identified in Tenda CP3 27.5.57.101 in the file Net/NetCheckPing.cpp. Manipulation of the interface_name/host arguments causes OS command injection. The attack can be initiated remotely.
- CVE-2026-86148Critical
A vulnerability has been discovered in Tenda CP3 27.5.57.101 in the SystemAsh function of the file Apis/system.c of the Kylin component. Manipulation of the AlarmVoiceURL argument results in OS command injection. The attack can be launched remotely.
Original NVD description (English source)
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.<br><br>The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.