CVE-2026-20251 describes a remote code execution vulnerability in Splunk Enterprise and related products caused by unsafe deserialization of App Key Value Store data using the 'jsonpickle' Python library. This library reconstructs arbitrary Python objects from specially crafted JSON without sufficient validation, enabling a low-privileged user lacking admin or power roles to execute arbitrary code remotely through the Splunk Secure Gateway app. The vulnerability affects multiple versions of Splunk Enterprise, Splunk Cloud Platform, and Splunk Secure Gateway below specified version thresholds. The CVSS 3.1 base score of 8.8 reflects the vulnerability's high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a low-privileged user to perform remote code execution on affected Splunk products, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected systems. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Splunk Secure Gateway app to trusted users only and monitor for suspicious activity related to deserialization processes. Avoid using untrusted data with the App Key Value Store. Follow vendor updates closely for patches or official mitigations.