CVE-2016-10126

9.8 criticalEPSS 4.0%

Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and 6.4.x before 6.4.4 allows remote attackers to conduct HTTP request injection attacks and obtain sensitive REST API authentication-token information via unspecified vectors, aka SPL-128840.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.0% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2017-01-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

splunk:splunk

References

http://www.securityfocus.com/bid/95412
https://www.splunk.com/view/SP-CAAAPSR
http://www.securityfocus.com/bid/95412
https://www.splunk.com/view/SP-CAAAPSR

Check your stack JSON