Splunk Addresses Critical Vulnerabilities Leading to DoS and Data Exposure

Severity: High (Score: 62.0)

Sources: Cybersecuritynews, advisory.splunk.com, cve.mitre.org, Hkcert

Published: 2026-05-22 · Updated: 2026-05-22

Keywords: splunk, vulnerabilities, multiple, sensitive, products, security, patches

Severity indicators: vulnerabilities, sensitive data

Summary

Splunk has issued security updates for vulnerabilities in Splunk Enterprise, Splunk Cloud Platform, and the Splunk AI Toolkit that could result in denial-of-service (DoS) attacks and sensitive data exposure. The vulnerabilities, disclosed on May 20, 2026, are tracked as CVE-2026-20238, CVE-2026-20239, and CVE-2026-20240. A remote attacker could exploit these flaws to bypass security restrictions and disclose sensitive information. The vulnerabilities affect multiple Splunk products, necessitating immediate attention from users. Patches have been released, and users are advised to apply them promptly to mitigate risks. The severity of these vulnerabilities is categorized as medium, but the potential for exploitation remains significant. Key Points: • Splunk patched three vulnerabilities affecting its major products. • The vulnerabilities could lead to DoS attacks and sensitive data exposure. • Users are urged to apply the released patches immediately.

Detailed Analysis

**Impact** Organizations using Splunk Enterprise, Splunk Cloud Platform, and the Splunk AI Toolkit are affected by vulnerabilities that could lead to denial-of-service (DoS) conditions and exposure of sensitive data. The scope includes any sector relying on these products globally, with potential operational disruptions and data confidentiality breaches. Specific numbers, sectors, or geographic details were not provided in the sources. **Technical Details** The vulnerabilities include CVE-2026-20238 (Splunk AI Toolkit Access Flaw), CVE-2026-20239, and CVE-2026-20240. Attackers could remotely exploit these flaws to cause DoS, bypass security restrictions, and disclose sensitive information. The attack vector involves remote exploitation of product vulnerabilities; no malware or specific tools were mentioned. Indicators of compromise (IOCs) were not detailed in the articles. **Recommended Response** Apply the security updates released by Splunk immediately to address the identified vulnerabilities. Review and harden access controls on Splunk AI Toolkit components. Monitor for unusual system behavior indicative of DoS or unauthorized data access attempts. No additional detection rules or IOCs were provided in the sources.

Source articles (7)

• Splunk Patches Multiple Vulnerabilities that Enable DOS Attack and Exposes Sensitive Data — Cybersecuritynews · 2026-05-22
  Splunk has released security updates addressing multiple vulnerabilities across Splunk Enterprise, Splunk Cloud Platform, and the Splunk AI Toolkit that could lead to denial-of-service (DoS) condition…
• SVD 2026 0504 — advisory.splunk.com · 2026-05-22
  In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a…
• SVD 2026 0503 — advisory.splunk.com · 2026-05-22
  In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the _in…
• CVE-2026-20239 — cve.mitre.org · 2026-05-22
• SVD 2026 0502 — advisory.splunk.com · 2026-05-22
  In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the ‘admin’ or ‘power’ roles could access confidential data that was restricted through srchFilter configurations on…
• CVE-2026-20238 — cve.mitre.org · 2026-05-22
• Splunk Products Multiple Vulnerabilities — Hkcert · 2026-05-22
  Multiple vulnerabilities were identified in Splunk products. A remote attacker could exploit some of these vulnerabilities to trigger sensitive information disclosure, security restriction bypass and…

Timeline

• 2026-05-20 — Vulnerabilities disclosed: Splunk announced three vulnerabilities that could lead to DoS and data exposure, tracked as CVE-2026-20238, CVE-2026-20239, and CVE-2026-20240.
• 2026-05-20 — CVE-2026-20239 published: Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
• 2026-05-20 — CVE-2026-20240 published: Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
• 2026-05-20 — CVE-2026-20238 published: Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
• 2026-05-22 — Patches released: Splunk issued security updates for vulnerabilities in its products, urging users to apply fixes immediately.

CVEs

• CVE-2026-20238
• CVE-2026-20239
• CVE-2026-20240

Related entities

• Data Breach (Attack Type)
• DDoS (Attack Type)
• Denial of Service (Attack Type)
• CWE-200 - Exposure of Sensitive Information (Cwe)
• CWE-20 - Improper Input Validation (Cwe)
• CWE-862 - Missing Authorization (Cwe)
• Splunk (Platform)
• Splunk AI Toolkit (Platform)
• Splunk Cloud Platform (Platform)
• Splunk Enterprise (Platform)
• Splunk AI Toolkit Access Flaw (Vulnerability)