CVE-2026-20204

In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles could potentially perform a Remote Code Execution (RCE) by uploading a malicious file to the `$SPLUNK_HOME/var/run/splunk/apptemp` directory due to improper handling and insufficient isolation of temporary files within the `apptemp` directory.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2026-0403	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:10.2.0::::enterprise:::

Configuration 2 (hide)

OR	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::

History

17 Apr 2026, 19:04

Type	Values Removed	Values Added
References	~~() https://advisory.splunk.com/advisories/SVD-2026-0403 -~~	() https://advisory.splunk.com/advisories/SVD-2026-0403 - Vendor Advisory
First Time		Splunk splunk Splunk Splunk splunk Cloud Platform
CPE		cpe:2.3:a:splunk:splunk:::::enterprise:::* cpe:2.3:a:splunk:splunk:10.2.0::::enterprise::: cpe:2.3:a:splunk:splunk_cloud_platform::::::::

15 Apr 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-15 16:16

Updated : 2026-06-17 10:17

NVD link : CVE-2026-20204

Mitre link : CVE-2026-20204

CVE.ORG link : CVE-2026-20204

JSON object : View

Products Affected

splunk

splunk_cloud_platform
splunk

CWE

CWE-377

Insecure Temporary File

{"id": "CVE-2026-20204", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20204", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.2", "lessThan": "10.2.1", "versionType": "custom"}, {"status": "affected", "version": "10.0", "lessThan": "10.0.5", "versionType": "custom"}, {"status": "affected", "version": "9.4", "lessThan": "9.4.10", "versionType": "custom"}, {"status": "affected", "version": "9.3", "lessThan": "9.3.11", "versionType": "custom"}]}, {"vendor": "Splunk", "product": "Splunk Cloud Platform", "versions": [{"status": "affected", "version": "10.4.2603", "lessThan": "Not Affected", "versionType": "custom"}, {"status": "affected", "version": "10.3.2512", "lessThan": "10.3.2512.5", "versionType": "custom"}, {"status": "affected", "version": "10.2.2510", "lessThan": "10.2.2510.9", "versionType": "custom"}, {"status": "affected", "version": "10.1.2507", "lessThan": "10.1.2507.19", "versionType": "custom"}, {"status": "affected", "version": "10.0.2503", "lessThan": "10.0.2503.13", "versionType": "custom"}, {"status": "affected", "version": "9.3.2411", "lessThan": "9.3.2411.127", "versionType": "custom"}]}]}], "published": "2026-04-15T16:16:34.490", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2026-0403", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-377"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles could potentially perform a Remote Code Execution (RCE) by uploading a malicious file to the `$SPLUNK_HOME/var/run/splunk/apptemp` directory due to improper handling and insufficient isolation of temporary files within the `apptemp` directory."}], "lastModified": "2026-06-17T10:17:17.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "9A537203-F31B-44A1-BB9E-C62F4539FA0B", "versionEndExcluding": "9.3.11", "versionStartIncluding": "9.3.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "0205D102-93C7-42FA-A33E-E517BB7760C4", "versionEndExcluding": "9.4.10", "versionStartIncluding": "9.4.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "D5A01879-50A5-4266-A08C-F55584F442ED", "versionEndExcluding": "10.0.5", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:10.2.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "122C01E6-CD7E-44B3-BC65-2ACEDFE704E5"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FCB2A3C-8069-4AAC-8746-4B9679DE8116", "versionEndExcluding": "9.3.2411.127", "versionStartIncluding": "9.3.2411"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5C098C2-9ED5-41B4-BE57-984B71027144", "versionEndExcluding": "10.0.2503.13", "versionStartIncluding": "10.0.2503"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2490F8A7-7B04-4E40-9414-02C050DAEB10", "versionEndExcluding": "10.1.2507.19", "versionStartIncluding": "10.1.2507"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C32CC18-1AF2-42B7-B4BF-D0E251BD8BDC", "versionEndExcluding": "10.2.2510.9", "versionStartIncluding": "10.2.2510"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8346F9C-302C-455A-9BE3-82C7C261830B", "versionEndExcluding": "10.3.2512.5", "versionStartIncluding": "10.3.2512"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}