Splunk Enterprise Vulnerabilities Expose Credentials and Enable Arbitrary SPL Searches
Article Content
- •Three critical vulnerabilities in Splunk Enterprise and Cloud Platform disclosed.
- •Flaws allow exposure of stored credential hashes and arbitrary SPL command execution.
- •Patches are available; immediate application is recommended to mitigate risks.
Splunk has issued security updates for three vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These vulnerabilities, tracked as CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298, were disclosed on July 15, 2026. They could lead to the exposure of stored credential hashes, arbitrary execution of SPL searches, and allow unauthorized file writing outside the intended application directory. Affected systems include both Splunk Enterprise and Splunk Cloud Platform, which are widely used for data analysis and monitoring. The flaws could potentially allow attackers to gain unauthorized access to sensitive information and execute arbitrary commands. Users are advised to apply the patches immediately to mitigate risks. The vulnerabilities were confirmed by Splunk in their security advisory.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-20296 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…