What’s Vulnerable › Vulnerabilities

CVE-2023-40598: Command Injection in Splunk Enterprise Using External Lookups

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-30 · updated 2026-06-17
• Weakness: CWE-77

Description

In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From there, a user can execute arbitrary code on the Splunk platform Instance.

Affected products

• Splunk Enterprise: before 8.2.12; from 9.0.0 before 9.0.6; from 9.1.0 before 9.1.1 — fixed in 8.2.12, 9.0.6, 9.1.1
• Splunk Cloud Platform: before 9.0.2305.200 — fixed in 9.0.2305.200

How to fix

Upgrade to a fixed version: Splunk Enterprise 8.2.12, 9.0.6, 9.1.1; Splunk Cloud Platform 9.0.2305.200. Check the vendor advisory for mitigations.

References

• https://advisory.splunk.com/advisories/SVD-2023-0807
• https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/
• https://advisory.splunk.com/advisories/SVD-2023-0807
• https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/

Get alerted when CVE-2023-40598 or the next vulnerability affects your stack