Multiple Splunk Enterprise Vulnerabilities Enable Path Traversal and Information Disclosure Attacks

Splunk released patches for three vulnerabilities in Splunk Enterprise and Cloud—CVE-2026-20296 (CVSS 8.3) allows arbitrary SPL execution via lack of CSRF validation when a user with list_deployment_server capability is phished; CVE-2026-20297 (CVSS 7.2) is a path traversal in the App Install REST endpoint that can write files outside the app directory; and CVE-2026-20298 (CVSS 5.3) can expose stored credential hashes via the /servicesNS/-/-/storage/passwords endpoint. Administrators should upgrade to the fixed releases or apply recommended mitigations (including masking encr_password and disabling Splunk Web where not needed).