Splunk Enterprise Vulnerabilities Expose Credentials and Enable Arbitrary SPL Searches

Splunk has issued security updates for three vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These vulnerabilities, tracked as CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298, were disclosed on July 15, 2026. They could lead to the exposure of stored credential hashes, arbitrary execution of SPL searches, and allow unauthorized file writing outside the intended application directory. Affected systems include both Splunk Enterprise and Splunk Cloud Platform, which are widely used for data analysis and monitoring. The flaws could potentially allow attackers to gain unauthorized access to sensitive information and execute arbitrary commands. Users are advised to apply the patches immediately to mitigate risks. The vulnerabilities were confirmed by Splunk in their security advisory.

Key Points: • Three critical vulnerabilities in Splunk Enterprise and Cloud Platform disclosed. • Flaws allow exposure of stored credential hashes and arbitrary SPL command execution. • Patches are available; immediate application is recommended to mitigate risks.