Medium severity · published Jun 10, 2026
CVE-2026-20260
Log Injection through HTTP Request Paths in Splunk SOAR
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
In Splunk SOAR (Security Orchestration, Automation, and Response) versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute (ANSI) escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might interpret when an administrator views the logs.<br><br>The injection is possible because SOAR does not strip control characters from HTTP request paths before writing them to application logs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Splunk SOAR · Splunk
8.5 before 8.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-20260
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-20260
advisory.splunk.com
https://advisory.splunk.com/advisories/SVD-2026-0611
More from Splunk SOAR
9.9
CVE-2026-76531
Files or Directories Accessible to External Parties in Splunk SOAR
8.8
CVE-2026-76530
Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR
8.8
CVE-2026-76526
Improper Neutralization in Splunk SOAR
8.1
CVE-2026-76356
Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR
7.6
CVE-2026-76357
Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR