CVE-2022-32157
Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients). Once enabled, deployment servers can manage only Universal Forwarder versions 9.0 and higher. Though the vulnerability does not directly affect Universal Forwarders, remediation requires updating all Universal Forwarders that the deployment server manages to version 9.0 or higher prior to enabling the remediation.
Key facts
- CVSS score
- 7.5 (v3.1)
- Severity
- HIGH
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
- CWE-306
- EPSS score
- 1.4% (71th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2022-53394)
- Published
- June 15, 2022
- NVD last modified
- June 17, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2022-53394 in the EU Vulnerability Database. Last updated in EUVD on September 17, 2024.
View on the EU Vulnerability DatabaseAffected products
- splunk / splunk
Certified products that may be affected
2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- Splunk Enterprise 8.1 - Splunk, Inc. - Common Criteria CCEVS-VR-VID-11108-2021 - archived
- Splunk Enterprise 6.4.5 - Splunk, Inc. - Common Criteria CCEVS-VR-VID-10780 - archived
References
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients(Mitigation, Vendor Advisory)
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates(Release Notes, Vendor Advisory)
- https://research.splunk.com/application/splunk_process_injection_forwarder_bundle_downloads/(Mitigation, Vendor Advisory)
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html(Vendor Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain