Vulnerability record · CVE-2022-32158 · published 15 June 2022
CVE-2022-32158: Splunk improper access control vulnerability
Splunk · Splunk
Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.
Description
Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates | Release NotesVendor Advisory |
| https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html | Vendor Advisory |
| https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates | Release NotesVendor Advisory |
| https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html | Vendor Advisory |
Track CVE-2022-32158 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-32158), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
