Remote Code Execution Vulnerability in Splunk Secure Gateway

Cvefeed

Remote Code Execution Vulnerability in Splunk Secure Gateway

First seen 11 Jun 2026, 01:27 UTC • •70.5

Article Content

1 / 4

Browse articles

ThreatCluster •June 12, 2026 at 00:34 UTC

•CVE-2026-20251 allows remote code execution for low-privileged users in Splunk products.
•Affected versions include Splunk Enterprise below 10.2.4 and Splunk Cloud Platform below 10.3.2512.12.
•Splunk rates this vulnerability as high severity (8.8) and recommends immediate action.

A critical vulnerability (CVE-2026-20251) has been identified in Splunk Enterprise, Splunk Cloud Platform, and Splunk Secure Gateway, allowing low-privileged users to execute remote code. This vulnerability arises from unsafe deserialization of App Key Value Store data via the 'jsonpickle' Python library. Affected versions include Splunk Enterprise below 10.2.4 and Splunk Cloud Platform below 10.3.2512.12. Splunk has rated this vulnerability as high severity (8.8) and recommends upgrading to the latest versions or removing the Splunk Secure Gateway app. The vulnerability was published on June 10, 2026, and poses a significant risk if not addressed promptly. Organizations are advised to monitor their systems and apply necessary updates or mitigations immediately.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 136d ago How this analysis works

Timeline

2026-06-10

CVE-2026-20251 published

Splunk disclosed a remote code execution vulnerability affecting multiple versions of its products.

Advisory.Splunk

More articles in this cluster (3)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Remote Code Execution
Zero-day Exploit

Vulnerability (1)

CVE-2026-20251

Weakness (1)

CWE-502 - Deserialization Of Untrusted Data

Affected Platform (1)

Splunk

Tool (1)

Jsonpickle

Relationships

Jsonpickle exploits CVE-2026-20251
CVE-2026-20251 targets Splunk
Remote Code Execution targets Splunk
Zero-day Exploit targets Splunk
CVE-2026-20251 related to CWE-502 - Deserialization Of Untrusted Data

Following this threat?

Track CVE-2026-20251 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…