Splunk Secure Gateway RCE Vulnerability Lets Low-Privileged Attackers Execute Arbitrary Code

A newly disclosed critical security flaw affects the Splunk Secure Gateway (SSG), enabling attackers with only basic privileges to execute arbitrary commands on affected systems. This issue is tracked as CVE-2026-20251 and has been assigned an 8.8 CVSS score ¹.

Security experts recommend immediate patching or implementing strict access controls if patches cannot be applied immediately due to technical constraints. The vulnerability arises from unsafe deserialization using Python's jsonpickle library when processing alert data stored within SSG’s KV Store collection "mobile_alerts" via its REST API endpoint ².

The attack chain involves writing malicious documents into the KV Store that trigger SSG during validation bypasses, ultimately allowing full control over system operations under administrative credentials held by lower-level accounts.