CVE-2011-4644: Splunk 4.2.5 and earlier, when a Free license is selected, enables potentially undesirable functionality wi...

Security readout for executives and security teams

CVE-2011-4644 affects Splunk 4.2.5 and earlier when running with a Free license. In that mode, Splunk intentionally lacks authentication, but the sources describe functionality that could let a remote attacker read arbitrary files or run management commands if the interface is reachable. Exposure is most likely in legacy Splunk 4.2.5 or earlier Free-license installations with the management console reachable from untrusted networks. Modern supported Splunk deployments are not established as affected by the supplied sources. Prioritize urgently if any legacy Splunk Free instance is network-accessible. The business risk is unauthorized file access or management action on monitoring infrastructure. If no such legacy deployment exists, treat this as a legacy exposure verification item. Mitigation focus: Identify any Splunk 4.2.5 or earlier Free-license deployments.; Check Splunk vendor guidance for fixed versions or supported migration paths.; Restrict management console access to trusted administrative networks only..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.