llm-wiki/raw/articles/splunk-secure-gateway-rce-2026.md

source_url, ingested, sha256, discovered_from, score

source_url	ingested	sha256	discovered_from	score
https://advisory.splunk.com/advisories/SVD-2026-0601	2026-06-30	fe3466546821450702237ad1014a0bb6bbba2647fcba18d6004aba84d0fc17aa	platform channel_id channel_name message_id author_id posted_at message_excerpt discord 1477793137064935675 tw 1521475788287774723 1477793167486226708 2026-06-30T11:21:35.581000000Z #tw digest mentioned Splunk Secure Gateway RCE as part of security-operations context.	2

Advisory ID: SVD-2026-0601

CVE ID: CVE-2026-20251

Published: 2026-06-10

Last Update: 2026-06-10

CVSSv3.1 Score: 8.8, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Bug ID: VULN-69217

Description

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.

The Remote Code Execution is possible because of unsafe deserialization of App Key Value Store (KV Store) data through the ‘jsonpickle’ Python library, which reconstructs arbitrary Python objects from specially crafted JavaScript Object Notation (JSON) without adequate validation.

See App Key Value Store and About role-based user access in the Splunk documentation for more information.

Solution

Upgrade Splunk Enterprise to versions 10.4.0, 10.2.4, 10.0.7, 9.4.12, and 9.3.13, or higher.

Splunk is actively monitoring and patching Splunk Cloud Platform instances.

Product Status

Product	Base Version	Component	Affected Version	Fix Version
Splunk Enterprise	10.4	Splunk Secure Gateway	Not affected	N/A
Splunk Enterprise	10.2	Splunk Secure Gateway	10.2.0 to 10.2.3	10.2.4
Splunk Enterprise	10.0	Splunk Secure Gateway	10.0.0 to 10.0.6	10.0.7
Splunk Enterprise	9.4	Splunk Secure Gateway	9.4.0 to 9.4.11	9.4.12
Splunk Enterprise	9.3	Splunk Secure Gateway	9.3.0 to 9.3.12	9.3.13
Splunk Cloud Platform	10.3.2512	Splunk Secure Gateway	Below 10.3.2512.12	10.3.2512.12
Splunk Cloud Platform	10.2.2510	Splunk Secure Gateway	Below 10.2.2510.14	10.2.2510.14
Splunk Cloud Platform	10.1.2507	Splunk Secure Gateway	Below 10.1.2507.22	10.1.2507.22
Splunk Cloud Platform	9.3.2411	Splunk Secure Gateway	Below 9.3.2411.132	9.3.2411.132
Splunk Secure Gateway	3.10		Below 3.10.6	3.10.6
Splunk Secure Gateway	3.9		Below 3.9.20	3.9.20
Splunk Secure Gateway	3.8		Below 3.8.67	3.8.67

Mitigations and Workarounds

Turn off or remove the Splunk Secure Gateway app. See Manage app and add-on objects in the Splunk documentation.

Note: Splunk Mobile, Spacebridge, and Mission Control rely on functionality in the Splunk Secure Gateway app. If you do not use any of these apps, features, or functionality, as a potential mitigation, you may turn off or remove the app.

Detections

None

Severity

Splunk rates this vulnerability an 8.8, High, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

If you remove or turn off the Splunk Secure Gateway app, there should be no impact and the severity would be Informational.

Acknowledgments

M Mahdan Argya Syarif (0xbeludan)