CERT-FR Advises on Splunk Universal Forwarder Vulnerabilities

CERT-FR Security Advisories

Published March 19th, 2026

Detected March 19th, 2026

Summary

CERT-FR has issued an advisory regarding multiple vulnerabilities discovered in Splunk Universal Forwarder. The advisory details affected versions and references Splunk's security bulletin for patch information. The vulnerabilities could allow an attacker to cause unspecified security issues.

View original document View source feed page

What changed

CERT-FR, the French national cybersecurity agency, has published an advisory (CERTFR-2026-AVI-0318) detailing multiple vulnerabilities in Splunk Universal Forwarder. Specifically, versions 10.0.x prior to 10.0.4 and 10.2.x prior to 10.2.1 are affected. The advisory notes that these vulnerabilities could allow an attacker to cause unspecified security problems, referencing CVEs CVE-2025-15467, CVE-2026-22795, and CVE-2026-22796.

Organizations using the affected Splunk Universal Forwarder versions are advised to consult Splunk's security bulletin (SVD-2026-0314) for remediation. While the advisory does not specify a direct compliance deadline, prompt patching is critical to mitigate the risk of exploitation and potential security breaches. Failure to apply patches could leave systems vulnerable to unauthorized access or disruption.

What to do next

Identify and inventory all Splunk Universal Forwarder instances.
Apply patches or updates as recommended by Splunk's security bulletin SVD-2026-0314 to versions 10.0.4 or 10.2.1 and later.
Review system logs for any signs of suspicious activity related to the identified vulnerabilities.

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 19 mars 2026 N° CERTFR-2026-AVI-0318 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans Splunk Universal Forwarder

Gestion du document

Risque

Non spécifié par l'éditeur

Systèmes affectés

Splunk Universal Forwarder versions 10.0.x antérieures à 10.0.4
Splunk Universal Forwarder versions 10.2.x antérieures à 10.2.1

Résumé

De multiples vulnérabilités ont été découvertes dans Splunk Universal Forwarder. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.