orca.securityadvisory

Orca: Splunk Enterprise Critical CVEs

Orca Security breaks down four new Splunk vulnerabilities: CVE-2026-20253 (CVSS 9.8), an unauthenticated arbitrary file create/truncate flaw in a PostgreSQL sidecar endpoint in Splunk Enterprise with no available workaround; CVE-2026-20251 (CVSS 8.8), a jsonpickle insecure-deserialization RCE in the Splunk Secure Gateway app exploitable by any low-privilege user; CVE-2026-20258, a stored XSS in classic dashboard HTML panels; and CVE-2026-20252, an SSRF in Dashboard Studio PDF export that bypasses trusted-domain validation via prefix matching and redirects. It lists affected Splunk Enterprise, Cloud Platform, and Secure Gateway version ranges and patched releases, plus interim mitigations like disabling Secure Gateway or Splunk Web.