High severity · published Nov 4, 2022
CVE-2022-43567
Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature
8.8
CVSS
1.3%
EPSS
No
On KEV
Description
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Splunk Enterprise · Splunk
8.1 before 8.1.12; 8.2 before 8.2.9; 9.0 before 9.0.2 · source: vendor
SP
Splunk · Splunk
8.1.0 before 8.1.12; 8.2.0 before 8.2.9; 9.0.0 before 9.0.2 · source: NVD
SC
Splunk Cloud Platform · Splunk
before 9.0.2205 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43567
Exploit
https://research.splunk.com/application/baa41f09-df48-4375-8991-520beea161be/
Vendor Advisory
https://www.splunk.com/en_us/product-security/announcements/svd-2022-1107.html
More from Splunk Enterprise
9.8
CVE-2026-20253
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
9.9
CVE-2026-76302
Security Hardening in Splunk Enterprise - October 2026
9.9
CVE-2026-76299
Security Hardening in Splunk Enterprise - October 2026
9.8
CVE-2026-76301
Security Hardening in Splunk Enterprise - October 2026
9.8
CVE-2026-76285
Improper Adherence to Coding Standards in Splunk Enterprise