TI-2022-13888 Aliases CVE-2022-32156 GHSA-775p-gpqh-xf63

Splunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validation

LOW 37CWE-295Published 2022-06-14 · Updated 2026-11-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI to enable the remediation. The vulnerability does not affect the Splunk Cloud Platform. At the time of publishing, we have no evidence of exploitation of this vulnerability by external parties. The issue requires conditions beyond the control of a potential bad actor such as a machine-in-the-middle attack. Hence, Splunk rates the complexity of the attack as High.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00835 57th percentileScored 2026-11-07

Fix Fixed Splunk Enterprise (Splunk): 9.0.0Universal Forwarder (Splunk): 9.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Splunk	Splunk Enterprise	before 9.0.0	9.0.0	Patch available	CNA
Splunk	Universal Forwarder	before 9.0.0	9.0.0	Patch available	CNA

Splunk Enterprise VendorSplunk Affected before 9.0.0 Fixed in 9.0.0 Patch available CNA
Universal Forwarder VendorSplunk Affected before 9.0.0 Fixed in 9.0.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:splunk:splunk:::::enterprise:::*	before 9.0	Vulnerable	Splunk
cpe:2.3:a:splunk:universal_forwarder::::::::	before 9.0	Vulnerable	Splunk

cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:* Versions before 9.0 Vulnerable ·Splunk
cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* Versions before 9.0 Vulnerable ·Splunk

Remediation

Fix · CNA Splunk Enterprise (Splunk) Fixed in 9.0.0
Fix · CNA Universal Forwarder (Splunk) Fixed in 9.0.0

Timeline

2026-10-02 Threatist record created from CVE-2022-32156
2026-10-03 Alias added: GHSA-775p-gpqh-xf63
2026-11-02 CISA SSVC decision points changed

References

Advisory 3

TI-2026-16444 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise KEVCVSS 3.1CRITICAL 9.8
TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
TI-2023-24841 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing CVSS 3.1HIGH 8.8
TI-2023-15979 ‘edit_user’ Capability Privilege Escalation CVSS 3.1HIGH 8.8
TI-2024-30707 Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows CVSS 3.1HIGH 8.8
TI-2022-21345 Reflected Cross-Site Scripting via the radio template in Splunk Enterprise CVSS 3.1HIGH 8.8

See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences