CVE-2026-20204: Splunk Enterprise RCE Vulnerability

CVE-2026-20204 Overview

CVE-2026-20204 is a Remote Code Execution (RCE) vulnerability affecting Splunk Enterprise and Splunk Cloud Platform. The vulnerability exists due to improper handling and insufficient isolation of temporary files within the $SPLUNK_HOME/var/run/splunk/apptemp directory. A low-privileged user that does not hold the admin or power Splunk roles could potentially perform remote code execution by uploading a malicious file to this directory.

Critical Impact
Low-privileged attackers can achieve remote code execution on Splunk Enterprise and Splunk Cloud Platform installations through malicious file uploads, potentially leading to full system compromise.

Affected Products

Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11
Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9
Splunk Cloud Platform versions below 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127

Discovery Timeline

2026-04-15 - CVE-2026-20204 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-20204

Vulnerability Analysis

This vulnerability stems from CWE-377 (Insecure Temporary File), where the Splunk application fails to properly secure temporary files in the apptemp directory. The core issue lies in the insufficient isolation of temporary files, allowing unauthorized users to interact with these files in unintended ways.

The vulnerability allows an authenticated user with minimal privileges (not requiring admin or power roles) to exploit the file upload mechanism. The attack requires network access and involves uploading a specially crafted malicious file to the vulnerable directory path. Once the malicious file is processed by Splunk, it can lead to arbitrary code execution in the context of the Splunk service.

The attack complexity is considered high due to the specific conditions required for successful exploitation, including user interaction. However, successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause is improper handling of temporary files within the $SPLUNK_HOME/var/run/splunk/apptemp directory. Splunk fails to implement adequate file isolation and validation mechanisms for files uploaded to this location, enabling privilege escalation through malicious file injection.

Attack Vector

The attack is network-based and requires authentication with a low-privileged account. An attacker must craft a malicious file designed to be executed when processed by Splunk's application handling routines. The attack vector involves:

Authenticating to the Splunk instance with a low-privileged user account
Uploading a malicious file to the $SPLUNK_HOME/var/run/splunk/apptemp directory
Triggering Splunk to process the malicious file, leading to code execution

The vulnerability manifests in the file upload and processing mechanism. For detailed technical information, refer to the Splunk Security Advisory SVD-2026-0403.

Detection Methods for CVE-2026-20204

Indicators of Compromise

Unexpected files appearing in the $SPLUNK_HOME/var/run/splunk/apptemp directory
Unusual process spawning from Splunk service accounts
Unauthorized file upload activity from low-privileged user accounts
Anomalous execution patterns in Splunk application logs

Detection Strategies

Monitor file system activity in the $SPLUNK_HOME/var/run/splunk/apptemp directory for suspicious file creations
Implement file integrity monitoring (FIM) on the Splunk installation directories
Review Splunk audit logs for file upload events from non-admin and non-power users
Deploy endpoint detection rules to identify unusual child processes spawned by Splunk services

Monitoring Recommendations

Enable verbose logging for file operations within Splunk directories
Configure SIEM alerts for file creation events in the apptemp directory
Establish baseline behavior for Splunk service processes to detect anomalous execution
Monitor network connections from Splunk services for unexpected outbound communications

How to Mitigate CVE-2026-20204

Immediate Actions Required

Upgrade Splunk Enterprise to versions 10.2.1, 10.0.5, 9.4.10, or 9.3.11 or later immediately
Upgrade Splunk Cloud Platform to versions 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, or 9.3.2411.127 or later
Review user accounts and restrict access to only necessary privileges
Audit recent activity from low-privileged users for signs of exploitation attempts

Patch Information

Splunk has released security patches addressing this vulnerability. Detailed patch information is available in the Splunk Security Advisory SVD-2026-0403. Organizations should prioritize applying these updates to all affected Splunk Enterprise and Splunk Cloud Platform installations.

Workarounds

Restrict file system permissions on the $SPLUNK_HOME/var/run/splunk/apptemp directory to limit write access
Implement network segmentation to limit access to Splunk management interfaces
Review and minimize the number of low-privileged user accounts with access to Splunk
Consider implementing additional file upload validation controls at the network level

bash

# Configuration example - Restrict apptemp directory permissions
chmod 750 $SPLUNK_HOME/var/run/splunk/apptemp
chown splunk:splunk $SPLUNK_HOME/var/run/splunk/apptemp
# Review current directory permissions
ls -la $SPLUNK_HOME/var/run/splunk/apptemp