Splunk Enterprise and Cloud Platform
CVE-2023-46214: Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Splunk Enterprise 9.0 | 9.0.7 or later |
| Splunk Enterprise 9.1 | 9.1.2 or later |
| Splunk Cloud - | 9.1.2308 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.