NCSC-2026-0247 [1.00] [M/H] Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform

unknownCVE-2026-20296 CVE-2026-20297 CVE-2026-20298

Splunk has fixed vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. The first vulnerability concerns insufficient CSRF protection and input validation in Deployment Server endpoints, allowing an attacker to execute arbitrary SPL queries under the splunk-system-user context with elevated privileges. This can lead to unauthorized access to sensitive stored credentials and indexed data. The second vulnerability is a path traversal issue where users with certain roles can install apps that can write files outside the intended app directory, specifically in the $SPLUNK_HOME/etc/ directory and subdirectories. This can result in unauthorized modification of configuration files or other sensitive data. The third vulnerability allows users without 'admin' or 'power' roles to access stored credential hashes via the /servicesNS/-/-/storage/passwords REST endpoint and the |rest SPL command, as the field encr_password is returned. These vulnerabilities affect the integrity and confidentiality of data within the affected Splunk products.

CSIRTS triage

vendor: Splunk product: Splunk Enterprise and Splunk Cloud PlatformCross-site request forgeryPath traversalOther

What: Vulnerabilities allow unauthorized access to sensitive data and modification of configuration files.
Who is affected: Users of Splunk Enterprise and Splunk Cloud Platform.
Urgency: Remediation is important due to the potential for unauthorized access and data exposure.
Action: Users should apply the latest updates provided by Splunk.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Splunk Enterprise and Splunk Cloud Platform

Get an email when a new Splunk Enterprise and Splunk Cloud Platform advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-07-17
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0247

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-202960.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all scored CVEs.
Low exploitation riskCVE-2026-202970.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all scored CVEs.
Low exploitation riskCVE-2026-202980.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-20296	coverage & exploitation status	NVD · CVE.org
CVE-2026-20297	coverage & exploitation status	NVD · CVE.org
CVE-2026-20298	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.