CVE WatchJul 16, 2026

CVE-2026-20296

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 1

CVSS

8.3

High

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Jul 15, 2026 · Last modified: Jul 16, 2026 · CWE-352

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-162026-07-17

Technical description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment_server` capability into running arbitrary Search Processing Language (SPL) searches on their behalf as `splunk-system-user`, allowing for access to stored credentials and indexed data.<br><br>The vulnerability is possible because Deployment Server endpoints in Splunk Web do not validate Cross-Site Request Forgery (CSRF) tokens on GET requests, and caller-supplied input is not correctly neutralized before it is placed into an SPL search.

Official references

advisory.splunk.comhttps://advisory.splunk.com/advisories/SVD-2026-0702

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2008-41284.3 MED

97.6%

KEV—79Cisco IOS Cross-Site Request Forgery Vulnerability4d CVE-2019-135298.8 HIG

86.2%

——26An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform actions with the permissions of the user on the Sunny WebBox Firmware Version 1.6 and prior. This device uses IP addresses to maintain communication after a successful login, which would increase the ease of exploitation.4d CVE-2020-183268.8 HIG

80.4%

——24Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary administrator user.9d CVE-2020-218848.8 HIG

63.1%

——19Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device.9d CVE-2020-288588.8 HIG

60.0%

——18OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly verify whether a request made to the application was intentionally made by the user, allowing for cross-site request forgery attacks on all user functions.9d CVE-2020-275748.8 HIG

50.9%

——15Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF). If an authenticated user visits a malicious page, unintended actions could be performed in the web application as the authenticated user.9d