Security Trust Portal

Last updated: October 23, 2026, 1pm ET | Status: Assessment in progress 

Overview  
Node.js has published security advisories for a vulnerability named Node2Shell (CVE-2026-111497). Sprinklr’s Security and Engineering teams have conducted an extensive investigation of our systems and services for impact and are pursuing mitigations as/if needed. 

Impact on Sprinklr  
Our assessment confirmed Node.js components within the Sprinklr environment. We are validating the exploitability of those components, with priority given to internet-accessible services. 

At this time, we have found no evidence that this vulnerability can be or has been successfully exploited within the Sprinklr environment. 

Remediation  
The Node.js components will be patched across all production environments in accordance with our vulnerability management program. Updates will be provided on this Sprinklr Trust Portal. 

Customer actions  
No action is required from customers at this time. 

Questions  
Please contact your Sprinklr account team who will escalate to Security internally. 

Last updated: October 22, 2026, 8:00 AM ET | Status: Remediation Complete 

The affected PHP functionality present on a limited number of internal endpoints have been successfully updated to the latest PHP version. Our Security team continues to monitor Sprinklr systems and will respond to any issues that arise. 

Last updated: October 21, 2026, 5:00 PM ET | Status: Assessment complete; remediation in progress 

Overview  
The PHP Group has published security advisories for CVE-2026-109618 and CVE-2026-109619 (PHP Security Advisory). Sprinklr’s Security and Engineering teams reviewed the advisories and completed an assessment of our systems and services. 

Impact on Sprinklr  
The affected PHP functionality is present on a limited number of internal endpoints that are not exposed to the internet. As of 5:00 PM ET on October 21, 2026, we have found no evidence of exploitability or exploitation. 

Remediation  
We will patch the affected components across all production environments in accordance with our vulnerability management program. 

Ongoing monitoring  
Our Security team continues to monitor Sprinklr systems and will respond to any issues that arise. We will keep investigating and addressing potential vulnerability reports as quickly as possible. We will update this article as new information becomes available. 

Customer actions  
No action is required from customers at this time. 

Questions  
Please contact your Sprinklr account team who will escalate to Security internally.  

If you are a Sprinklr customer and suspect a security issue or have a related concern, please notify your Sprinklr Account team or submit a support ticket by emailing tickets@sprinklr.com.

All reported security concerns are promptly escalated to Sprinklr’s Security Incident Response Team (SIRT) for review and investigation. From that point forward, the matter is managed in accordance with Sprinklr’s established Incident Response processes.

If you believe you have found a vulnerability in our products, please responsibly disclose this information to us through our HackOne bug bounty program. You will be recognized for your efforts if you were the first to report a valid vulnerability as per the rules of the vulnerability disclosure program.

More details about Sprinklr’s Vulnerability Disclosure Program and how to submit can be found here: https://www.sprinklr.com/responsible-disclosure/

As an organization that is conscious of, and values, security and privacy, we are excited to announce the official launch of the Sprinklr Security & Privacy Trust Center. By using this portal, you can request access to our compliance documents, review our standardized questionnaires such as the SIG and gain a general understanding of our privacy and security posture.

Over time, our team will be making changes to this portal as we implement new tools and processes in our environment. You can use the "Subscribe" button to receive email notifications for when our team has an important update, such as if we have an updated compliance report or if we have a status update regarding a major security vulnerability that has been recently discovered.

-The Sprinklr Security Team