Splunk Addresses Critical Vulnerabilities in Enterprise and Cloud Platforms

Splunk released updates addressing 16 vulnerabilities — most prominently CVE-2024-36985 (RCE via External Lookup using copybuckets.py in splunk_archiver) and CVE-2024-36984 (authenticated code execution via serialized session payload). Affected Splunk Enterprise versions precede 9.0.10, 9.1.5, and 9.2.2; Splunk recommends prompt upgrades or temporarily disabling the splunk_archiver app as mitigation, and reports no observed active exploitation.