CVE-2026-20204
Full vulnerability record from the local CVENow database.
Description
In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles could potentially perform a Remote Code Execution (RCE) by uploading a malicious file to the `$SPLUNK_HOME/var/run/splunk/apptemp` directory due to improper handling and insufficient isolation of temporary files within the `apptemp` directory.
Severity
HIGH
CVSS score
7.1
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-15 16:16:34.490000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-20204",
"sourceIdentifier": "[email protected]",
"published": "2026-04-15T16:16:34.490",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles could potentially perform a Remote Code Execution (RCE) by uploading a malicious file to the `$SPLUNK_HOME/var/run/splunk/apptemp` directory due to improper handling and insufficient isolation of temporary files within the `apptemp` directory."
},
{
"lang": "es",
"value": "En las versiones de Splunk Enterprise anteriores a 10.2.1, 10.0.5, 9.4.10 y 9.3.11, y en las versiones de Splunk Cloud Platform anteriores a 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13 y 9.3.2411.127, un usuario con pocos privilegios que no posee los roles de Splunk ’admin’ o ’power’ podría potencialmente realizar una Ejecución Remota de Código (RCE) al cargar un archivo malicioso en el directorio ’$SPLUNK_HOME/var/run/splunk/apptemp’ debido a un manejo inadecuado y a un aislamiento insuficiente de los archivos temporales dentro del directorio ’apptemp’."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Splunk",
"product": "Splunk Enterprise",
"versions": [
{
"version": "10.2",
"lessThan": "10.2.1",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.0",
"lessThan": "10.0.5",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.4",
"lessThan": "9.4.10",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.3",
"lessThan": "9.3.11",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Splunk",
"product": "Splunk Cloud Platform",
"versions": [
{
"version": "10.4.2603",
"lessThan": "Not Affected",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.3.2512",
"lessThan": "10.3.2512.5",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.2.2510",
"lessThan": "10.2.2510.9",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.1.2507",
"lessThan": "10.1.2507.19",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.0.2503",
"lessThan": "10.0.2503.13",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.3.2411",
"lessThan": "9.3.2411.127",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-15T00:00:00+00:00",
"id": "CVE-2026-20204",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-377"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.3.0",
"versionEndExcluding": "9.3.11",
"matchCriteriaId": "9A537203-F31B-44A1-BB9E-C62F4539FA0B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.4.0",
"versionEndExcluding": "9.4.10",
"matchCriteriaId": "0205D102-93C7-42FA-A33E-E517BB7760C4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.0.0",
"versionEndExcluding": "10.0.5",
"matchCriteriaId": "D5A01879-50A5-4266-A08C-F55584F442ED"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:10.2.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "122C01E6-CD7E-44B3-BC65-2ACEDFE704E5"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "9.3.2411",
"versionEndExcluding": "9.3.2411.127",
"matchCriteriaId": "6FCB2A3C-8069-4AAC-8746-4B9679DE8116"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.0.2503",
"versionEndExcluding": "10.0.2503.13",
"matchCriteriaId": "D5C098C2-9ED5-41B4-BE57-984B71027144"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.1.2507",
"versionEndExcluding": "10.1.2507.19",
"matchCriteriaId": "2490F8A7-7B04-4E40-9414-02C050DAEB10"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.2.2510",
"versionEndExcluding": "10.2.2510.9",
"matchCriteriaId": "7C32CC18-1AF2-42B7-B4BF-D0E251BD8BDC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.3.2512",
"versionEndExcluding": "10.3.2512.5",
"matchCriteriaId": "D8346F9C-302C-455A-9BE3-82C7C261830B"
}
]
}
]
}
],
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2026-0403",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}