High severity · published May 6, 2022
CVE-2021-26253
A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6
8.1
CVSS
0.8%
EPSS
No
On KEV
Description
A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does not impact or affect a DUO product or service.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Splunk · Splunk
8.1.0 before 8.1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26253
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26253
Vendor Advisory
https://www.splunk.com/en_us/product-security/announcements/svd-2022-0504.html
More from Splunk
9.8
CVE-2026-20253
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
7.5
CVE-2014-0160
OpenSSL Information Disclosure Vulnerability
10.0
CVE-2022-32158
Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server
9.8
CVE-2026-76285
Improper Adherence to Coding Standards in Splunk Enterprise
9.8
CVE-2026-76284
Improper Neutralization in Splunk Enterprise