CVE-2026-20251

CVE-2026-20251 is an insecure deserialization vulnerability (CWE-502) in the Splunk Secure Gateway app that can lead to remote code execution on Splunk Enterprise and Splunk Cloud Platform. A low-privileged user who does not hold the 'admin' or 'power' roles can trigger it through the Secure Gateway app: specially crafted JSON stored in the App Key Value Store (KV Store) is deserialized by the 'jsonpickle' Python library, which reconstructs arbitrary Python objects without adequate validation. Successful exploitation gives the attacker arbitrary code execution on the affected Splunk instance, with high impact to confidentiality, integrity, and availability reflected in the 8.8 (High) CVSS 3.1 score. All Splunk Enterprise deployments below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform deployments below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Secure Gateway app versions below 3.10.6, 3.9.20, and 3.8.67 are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known and the issue is not yet in CISA KEV, but the EPSS score of 32.2% (98th percentile) signals an elevated likelihood of exploitation within 30 days.

What to do: Upgrade Splunk Enterprise to 10.2.4, 10.0.7, 9.4.12, or 9.3.13 (or later on each line) and the Splunk Secure Gateway app to 3.10.6, 3.9.20, or 3.8.67 as applicable; Splunk Cloud Platform instances should be brought to 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, or 9.3.2411.132 via Splunk's managed update process. Until patched, restrict access to Splunk web, audit and minimize accounts that lack the admin or power roles, and monitor for unexpected child processes spawned by the Splunk service. Given the elevated EPSS score, treat patching as high priority.