---
id: CVE-2022-32156
title: >-
  Splunk Enterprise and Universal Forwarder CLI connections lacked TLS cert
  validation
summary: >-
  In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk
  command-line interface (CLI) did not validate TLS certificates while
  connecting to a remote Splunk platform instance by default. After updating to
  version 9.0, …
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-295
vendor: Splunk
product: Splunk Enterprise
affected:
  - enterprise < 9.0.0
  - universal_forwarder < 9.0.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T22:09:46.780828Z'
published: '2022-06-14'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T22:10:03.157Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-32156'
references:
  - url: >-
      https://www.splunk.com/en_us/product-security/announcements/svd-2022-0606.html
  - url: 'https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates'
  - url: >-
      https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI
tags:
  - cve.org
epss: 0.00835
epssPercentile: 0.57914
ingestedAt: '2026-11-05T19:30:42.867Z'
---

## Overview

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see  Configure TLS host name validation for the Splunk CLI https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI  to enable the remediation. The vulnerability does not affect the Splunk Cloud Platform. At the time of publishing, we have no evidence of exploitation of this vulnerability by external parties.

The issue requires conditions beyond the control of a potential bad actor such as a machine-in-the-middle attack. Hence, Splunk rates the complexity of the attack as High.

## Affected

- `enterprise < 9.0.0`
- `universal_forwarder < 9.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.