CVE-2026-20260: fallo de gravedad media en Splunk SOAR
Log Injection through HTTP Request Paths in Splunk SOAR
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.2%
In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute (ANSI) escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might interpret when an administrator views the logs.<br><br>The injection is possible because SOAR does not strip control characters from HTTP request paths before writing them to application logs.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Productos afectados
Splunk · Splunk SOARCVEs relacionadas — Splunk SOAR
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-76356HIGHAuthentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAREPSS 0.6%CVE-2026-76359MEDIUMPath Traversal through Universal Forwarder Installer Archive Extraction in Splunk SOAREPSS 0.5%CVE-2026-76358MEDIUMPath Traversal through App Installation Tar Extraction in Splunk SOAREPSS 0.5%CVE-2026-76357HIGHRemote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAREPSS 0.4%CVE-2026-76527CRITICALImproper Check or Handling of Exceptional Conditions in Splunk SOAREPSS 0.4%CVE-2026-76407CRITICALImproper Access Control in Splunk SOAREPSS 0.4%