CVE-2025-20384Medium· 5.3▾ TwilightPoC availableIn Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
1 GitHub repo (last check)
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files due to improper validation at the /en-US/static/ web endpoint. This may allow them to poison, forge, or obfuscate sensitive log data through specially crafted HTTP requests, potentially impacting log integrity and detection capabilities.
splunk >= 9.2.0, < 9.2.10splunk >= 9.3.0, < 9.3.8splunk >= 9.4.0, < 9.4.6splunk = 10.0.0splunk_cloud_platform >= 9.3.2411, < 9.3.2411.117splunk_cloud_platform >= 10.0.2503, < 10.0.2503.6splunk_cloud_platform >= 10.1.2507, < 10.1.2507.4Upgrade past the affected range:
splunk 9.4.6splunk_cloud_platform 10.1.2507.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76267Medium· 4.3In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API
CVE-2026-76268Critical· 9.8In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execut…
CVE-2026-76285Critical· 9.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
CVE-2026-76282High· 8.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
CVE-2026-76283High· 7.6As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
CVE-2026-76284Critical· 9.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review