Splunk Enterprise and Cloud Platform
CVE-2023-32706: Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication
On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service in the Splunk daemon.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Splunk Enterprise 8.1 | 8.1.14 or later |
| Splunk Enterprise 8.2 | 8.2.11 or later |
| Splunk Enterprise 9.0 | 9.0.5 or later |
| Splunk Cloud Platform 9.0 | 9.0.2303.100 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, an unauthenticated attacker can send specially-crafted messages to the XML parser within SAML authentication to cause a denial of service in the Splunk daemon.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.