CVE-2024-36991: Splunk Enterprise on Windows path traversal, unauthenticated file read
The short version: Splunk Enterprise on Windows has a path-traversal flaw (CVE-2024-36991) that lets an unauthenticated attacker walk out of the intended web directory and read arbitrary files from the host. It only affects the Windows builds, a patch is out, and confirming whether you're exposed is quick. Steady hands — but patch.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | ~13.1% · 95.9th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not confirmed in KEV; the technique is trivial and public |
| Vulnerability type | CWE-22 path traversal → unauthenticated arbitrary file read |
| Requires authenticated session? | No — pre-authentication |
| Affected | Splunk Enterprise on Windows below 9.2.2, 9.1.5, and 9.0.10 |
| Fixed in | 9.2.2 · 9.1.5 · 9.0.10 (and later) |
What you need to know
CVE-2024-36991 is a path traversal on the /modules/messaging/ endpoint of Splunk Enterprise on Windows. By inserting directory-traversal sequences into the request, an unauthenticated attacker escapes the web root and reads files elsewhere on the disk.
The reason a "read-only" bug matters here is what an attacker reads next. Splunk holds the keys to a lot of an organization's telemetry, and files on the host can include configuration and secrets that lead to authenticated access. An arbitrary file read on an internet-facing analytics platform is a foothold, not a curiosity.
- It's pre-authentication and network-reachable — no credential required, just a crafted request.
- It's platform-specific — this affects the Windows builds; Splunk states it should not affect other platforms.
How serious we see it
Moderate — in practice, matching the 7.5 band.
This isn't a "leaks one static page" bug; it's an unauthenticated read of arbitrary files on a security-relevant server, and the endpoint and technique are public. We stop short of Critical because it isn't in CISA's KEV catalog and we've seen no confirmation of mass exploitation — but an internet-facing Splunk on an affected Windows build should be treated as urgent. The reassuring part is that it's narrow and fixed: specific Windows versions, a published patch, and exposure you can confirm in minutes.
Recommendations
Straight from Splunk's advisory (SVD-2024-0711):
- Patch now. Upgrade Splunk Enterprise to 9.2.2 / 9.1.5 / 9.0.10 or later.
- Restrict exposure in the meantime. Limit who can reach the Splunk web interface from the internet; put it behind a VPN or trusted-IP allowlist until patched.
- Rotate if you suspect exposure. If the instance was internet-facing and unpatched, rotate secrets and session material that could have been read from disk.
- Confirm your exposure first. Verify whether you run Splunk Enterprise on Windows at all, and on which build.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers exposed Splunk Enterprise interfaces, fingerprints the product and version, and flags exposure tied to this CVE. Where safe verification is possible, it goes a step beyond fingerprinting: it issues a single bounded, non-destructive request that reads a harmless system file to confirm the traversal actually works — proof, not a maybe, and never a weaponized exploit.
That outside-in, continuous view means an exposed, affected Splunk is already on your map — so you can go straight to patch-and-verify instead of hunting for it.