CVE-2026-20239High· 7.5▾ TwilightIn Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the `_internal` index could view session coo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the _internal index could view session cookies and response bodies that contain sensitive data.
splunk >= 10.0.0, < 10.0.5splunk >= 10.2.0, < 10.2.2splunk_cloud_platform >= 10.0.2503, < 10.0.2503.13splunk_cloud_platform >= 10.1.2507, < 10.1.2507.21splunk_cloud_platform >= 10.2.2510, < 10.2.2510.11splunk_cloud_platform >= 10.3.2512, < 10.3.2512.8Upgrade past the affected range:
splunk 10.2.2splunk_cloud_platform 10.3.2512.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76285Critical· 9.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
CVE-2026-76282High· 8.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
CVE-2026-76283High· 7.6As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
CVE-2026-76284Critical· 9.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review
CVE-2026-76278Medium· 4.3In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the affected Representational State Transfer (REST) API to access permission grants for …
CVE-2026-76279Medium· 4.3In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to write events to internal indexes outside …