Vulnerabilities
Splunk Secure Gateway RCE via Unsafe Deserialization (SVD-2026-0601)
A low‑privileged user can execute arbitrary code on Splunk Enterprise and Cloud Platform instances by sending crafted JSON to the Secure Gateway app. The flaw exists in Splunk versions prior to 10.2.4, 10.0.7, 9.4.12, 9.3.13, and corresponding Cloud and Secure Gateway releases. Defenders should upgrade immediately or apply the vendor’s patch and restrict access to the Secure Gateway app.
What Happened
Splunk Secure Gateway deserializes KV Store data using the jsonpickle library without validating the payload. A crafted JSON can instantiate arbitrary Python objects, allowing a low‑privileged user to execute code on the host.
Impact
All Splunk Enterprise releases below 10.2.4, 10.0.7, 9.4.12, 9.3.13; Splunk Cloud Platform releases below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, 9.3.2411.132; and Secure Gateway releases below 3.10.6, 3.9.20, 3.8.67 are vulnerable. Attackers with non‑admin roles can gain full code execution on the underlying OS.
What to Do
- Verify the running version of Splunk Enterprise, Cloud Platform, and Secure Gateway.
- Upgrade to the latest patched releases (≥10.2.4, ≥10.0.7, ≥9.4.12, ≥9.3.13 for Enterprise; ≥10.3.2512.12, ≥10.2.2510.14, ≥10.1.2507.22, ≥9.3.2411.132 for Cloud; ≥3.10.6, ≥3.9.20, ≥3.8.67 for Secure Gateway).
- If upgrade is not immediately possible, restrict user roles that can access the Secure Gateway app and monitor for anomalous JSON traffic.
Mitigation
Apply the vendor’s patch, disable the Secure Gateway app for non‑trusted users, and enforce strict role‑based access controls. Consider network segmentation to isolate the Secure Gateway service.
Related vulnerabilities
Grid Protection Alliance openPDC & openHistorian Vulnerabilities: CVE-2026-100730 and Related Issues
Grid Protection Alliance’s openPDC and openHistorian contain multiple critical flaws, including deserialization of untrusted data, missing authentication, SSRF, hard‑coded credentials, and unsafe reflection. Versions below 2.9.482 (openPDC) and 2.8.585 (openHistorian) are affected. Administrators should update to the latest releases and review authentication settings.
Read briefing
Splunk Issues Security Hardening Release for Multiple Apps and Add-ons (SVD-2026-0808)
Splunk has published a security hardening advisory addressing multiple vulnerabilities affecting several enterprise apps and add-ons, including the Splunk AI Toolkit and Cisco Talos Intelligence integration. Defenders must review the advisory details and update affected components immediately to mitigate high-severity risks such as RCE and SSRF.
Read briefing
Cisco Secure Email Gateway CVE-2026-76461 Zero-Day Exploited in the Wild
Cisco has patched a critical SQL injection vulnerability, tracked as CVE-2026-76461, in the AsyncOS software used by Cisco Secure Email Gateway. The flaw allows unauthenticated, remote attackers to achieve root-level command execution via crafted emails and is actively exploited in the wild. SecOps and sysadmins must immediately apply the vendor-supplied firmware updates.
Read briefing
Citrix Releases Patch for CVE-2026-107406: Critical NetScaler Memory Overflow Enabling RCE in SAML Deployments
Citrix has issued security updates for NetScaler ADC and Gateway to fix CVE-2026-107406, a 9.5‑score memory overflow that can lead to remote code execution or denial‑of‑service when the appliance is configured as a SAML IdP or SP. All affected versions must be upgraded to 14.1‑73.46 or later, or 13.1‑64.29 or later, and Secure Private Access deployments should be reviewed.
Read briefing