CVE-2022-43571: high-severity vulnerability in Splunk Enterprise
Remote Code Execution through dashboard PDF generation component in Splunk Enterprise
Published · Updated
41Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 8.8epss 14%
from disclosure to weapon0 days
Published on NVDNov 3
metasploitNov 2
exploitation probability
14%top 4% of all CVEs
observed exploitation
nono source reports it
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Splunk · Splunk EnterpriseRelated CVEs — Splunk Enterprise
In the same product, most dangerous first.
CVE-2026-20253CRITICALUnauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk EnterpriseEPSS 96.9%KEVCVE-2023-46214HIGHRemote code execution (RCE) in Splunk Enterprise through Insecure XML ParsingEPSS 89.2%CVE-2023-32707HIGH‘edit_user’ Capability Privilege EscalationEPSS 79.0%CVE-2022-43568HIGHReflected Cross-Site Scripting via the radio template in Splunk EnterpriseEPSS 42.8%CVE-2026-20251HIGHRemote Code Execution through Deserialization of Untrusted Data in Splunk Secure GatewayEPSS 32.2%CVE-2025-20297MEDIUMReflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation componentEPSS 29.3%