Splunk Enterprise Flaws Expose Stored Credentials and Allow Arbitrary SPL Searches

Gbhackers •Divya • July 16, 2026

Splunk has released security updates for three vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These vulnerabilities could potentially expose stored credential hashes, enable arbitrary Processing Language (SPL) searches, and allow files to be written outside of the intended application directory. The flaws, tracked as CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298, were disclosed on July 15, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Splunk Enterprise Vulnerabilities Expose Credentials and Enable Arbitrary SPL Searches Splunk has issued security updates for three vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These vulnerabilities, tracked as CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298, were disclosed on July 15, 2026. They could lead to the exposure of stored credential hashes, arbitrary execution of SPL searches, and allow unauthorized file writing outside the intended application directory. Affected systems include both Splunk Enterprise and Splunk Cloud Platform, which are widely used for data analysis and monitoring. The flaws could potentially allow attackers to gain unauthorized access to sensitive information and execute arbitrary commands. Users are advised to apply the patches immediately to mitigate risks. The vulnerabilities were confirmed by Splunk in their security advisory. 2 sources 71

Extracted Entities

Splunk Enterprise Flaws Expose Stored Credentials and Allow Arbitrary SPL Searches

The full story

Extracted Entities

Attack Types (1)

CVEs (3)

CWE Weaknesses (2)

Platforms (3)