CVE-2026-76288 Denial of Service (DoS) through Splunk Web Content-Type Header Parsing in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarte...

CVE-2026-76287 Authorization Bypass in the Data Management REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, a user that holds a role with the previewdatamanagementpipeline capability or editdatamanagementpipelinejob capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope. The vulnerability is possible becaus...

CVE-2026-76287

Splunk Enterprise versions prior to 10.4.4 are vulnerable to an authorization bypass in the Data Management REST API . A user with the preview_data_management_pipeline or edit_data_management_pipeline_job capability can read or delete Data Management SPL2 preview jobs and results outside their ow...

CVE-2024-36985

CVE-2024-36985 All the exploit codes are genetrated by gemini. Splunk admin role required. Splunkarchiver application enabled. You can also run below SPL in search to trigger the RCE. | copybuckets data=""providers": "pwnprovider": "command.arg.0":...

CorelightForSplunk

CorelightForSplunk...

struts-splunk

struts-splunk Vuln Apache Struts with splunk...

CVE-2024-36991

CVE-2024-36991 Path Traversal On The “/Modules/Messaging/“ Endpoint In Splunk Enterprise On Windows In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. The vulnerability exist...

PT-2026-120856

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8 Description A user without admin or power roles can derive the PostgreSQL sidecar database superuser password. This occurs because the PostgreSQL sidecar...

CVE-2022-43571

CVE-2022-43571 CVE-2022-43571 Splunk RCE – my personal journey to color your life Only because I got the statement from my IT, there are no reasons for a SPLUNK update, I analyzed this vulnerability CVE-2022-43571 to prove the opposite for a remote code execution. Here is my exploit. If I had fou...

CVE-2024-36991

CVE-2024-36991 Path traversal vulnerability in Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10 that allows reading sensitive files...

CVE-2023-32707

CVE-2023-32707 An improved POC exploit based on the reported CVE on exploitdb Exploit Title: Splunk 9.0.5 - Admin Account Takeover CVE: CVE-2023-32707 Overview This script allows for exploiting a vulnerability in Splunk 9.0.5, leading to admin account takeover. The exploit leverages a low-privile...

patch-CVE-2026-28001

Patch: CVE-2026-28001 Vulnerability Details CVE : CVE-2026-28001 Product : Splunk Enterprise Description : Remote code execution in SPL parsing Severity : Critical Patch Status: DEPLOYED Field| Value ---|--- Patch Date| 2026-07-22 Status| deployed Deployed To| Production Validated By| SecOps Team...

windows-malware-behavioral-analysis

Behavioral Malware Analysis using REMnux & FLARE-VM A practical Blue Team malware investigation demonstrating how suspicious Windows executables can be analyzed safely inside an isolated laboratory using behavioral analysis techniques. Rather than reverse engineering malware source code, this...

CVE-2024-36991

CVE-2024-36991 - Splunk Path Traversal Proof of Concept for CVE-2024-36991 which allows an attacker to read arbitrary files in Splunk for versions below to 9.2.2, 9.1.5, and 9.0.10 for Windows. Usage Read Splunk configuration files To read Splunk files just run the script passing the target URL...

C2-detection-manjusaka

Detecting the "Manjusaka" C2 framework Detecting the C2 framework Manjusaka: "A Chinese sibling of Sliver and Cobalt Strike" References: Detection logic details: https://corelight.com/blog/detecting-manjusaka-c2-framework Writeup by Talos:...

CVE-2024-36991

Splunk Path Traversal Exploit CVE-2024-36991 Description This is a Proof-of-Concept PoC exploit script for CVE-2024-36991 , a path traversal vulnerability affecting Splunk Enterprise on Windows versions below: 9.2.2 9.1.5 9.0.10 The vulnerability allows unauthenticated attackers to access sensiti...

CVE-2024-36991-Tool

CVE-2024-36991-Tool This binary POC automates the exploitation of CVE-2024-36991 by sending crafted curl requests to a vulnerable Splunk instance. It retrieves sensitive files and saves them locally for further analysis. The script is modular, allowing users to target specific file categories e.g...

CVE-2024-36991-Splunk

CVE-2024-36991 — Splunk Path Traversal interactive POC for the Splunk Enterprise path traversal vulnerability on Windows. Vulnerability Info Field| Detail ---|--- CVE| CVE-2024-36991 Type| CWE-22 — Path Traversal Severity| HIGH CVSS Score| 7.5 Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N...

attack_range

Splunk Attack Range v5 El Splunk Attack Range construye entornos cloud instrumentados AWS, Azure, GCP, simula ataques y reenvía datos a Splunk para el desarrollo y pruebas de detección. Qué hace: Construye laboratorios — Despliega un laboratorio pequeño y similar a producción Splunk, servidores...

Vulnerabilities in Splunk Enterprise

Splunk has identified several vulnerabilities in Splunk Enterprise. These vulnerabilities apply to various versions of Splunk Enterprise and include insufficient authorization checks in REST API endpoints, allowing unauthorized users to access privileged functions or sensitive data. Some of these...