A low‑privileged user who does not have the ‘admin’ or ‘power’ roles can leverage an unsafe deserialization flaw in the Splunk Secure Gateway app to execute arbitrary code. The vulnerability is caused by the jsonpickle Python library reconstructing Python objects from specially crafted JSON without adequate validation, allowing an attacker to inject malicious code into the App Key Value Store (KV Store).

The flaw affects Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, as well as Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67.

The CVSS score of 8.8 indicates high severity, and while the EPSS score is not available, the vulnerability can be exploited by a legitimate user with limited privileges, suggesting a wide attack surface within the organization. As the vulnerability is listed as not part of the CISA KEV catalogue, it may not yet have widespread exploitation, but the nature of the RCE capability makes it a critical risk for any affected Splunk deployment.