Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise

Advisory ID: SVD-2026-0403

CVE ID: CVE-2026-20204

Published: 2026-04-15

Last Update: 2026-04-15

CVSSv3.1 Score: 7.1, High

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-377

Bug ID: VULN-39504

Description

In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the admin or power Splunk roles could potentially perform a Remote Code Execution (RCE) by uploading a malicious file to the $SPLUNK_HOME/var/run/splunk/apptemp directory due to improper handling and insufficient isolation of temporary files within the apptemp directory.

Solution

Upgrade Splunk Enterprise to versions 10.2.1, 10.0.5, 9.4.10, 9.3.11, or higher.

Splunk is actively monitoring and patching Splunk Cloud Platform instances.

Product Status

ProductBase VersionComponentAffected VersionFix Version
Splunk Enterprise10.2Splunk Web10.2.010.2.1
Splunk Enterprise10.0Splunk Web10.0.0 to 10.0.410.0.5
Splunk Enterprise9.4Splunk Web9.4.0 to 9.4.99.4.10
Splunk Enterprise9.3Splunk Web9.3.0 to 9.3.109.3.11
Splunk Cloud Platform10.4.2603Splunk WebNot AffectedNot Affected
Splunk Cloud Platform10.3.2512Splunk WebBelow 10.3.2512.510.3.2512.5
Splunk Cloud Platform10.2.2510Splunk WebBelow 10.2.2510.910.2.2510.9
Splunk Cloud Platform10.1.2507Splunk WebBelow 10.1.2507.1910.1.2507.19
Splunk Cloud Platform10.0.2503Splunk WebBelow 10.0.2503.1310.0.2503.13
Splunk Cloud Platform9.3.2411Splunk WebBelow 9.3.2411.1279.3.2411.127

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on, turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning off Splunk Web.

Detections

None

Severity

Splunk rates this vulnerability a 7.1, High, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.

Acknowledgments

Gabriel Nitu, Splunk