CVE-2026-20204: Splunk Enterprise RCE Vulnerability

CVE-2026-20204 Overview

CVE-2026-20204 is a Remote Code Execution (RCE) vulnerability affecting Splunk Enterprise and Splunk Cloud Platform. The vulnerability exists due to improper handling and insufficient isolation of temporary files within the $SPLUNK_HOME/var/run/splunk/apptemp directory. A low-privileged user that does not hold the admin or power Splunk roles could potentially perform remote code execution by uploading a malicious file to this directory.

Critical Impact

Low-privileged attackers can achieve remote code execution on Splunk Enterprise and Splunk Cloud Platform installations through malicious file uploads, potentially leading to full system compromise.

Affected Products

• Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11
• Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9
• Splunk Cloud Platform versions below 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127

Discovery Timeline

• 2026-04-15 - CVE-2026-20204 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-20204

Vulnerability Analysis

This vulnerability stems from CWE-377 (Insecure Temporary File), where the Splunk application fails to properly secure temporary files in the apptemp directory. The core issue lies in the insufficient isolation of temporary files, allowing unauthorized users to interact with these files in unintended ways.

The vulnerability allows an authenticated user with minimal privileges (not requiring admin or power roles) to exploit the file upload mechanism. The attack requires network access and involves uploading a specially crafted malicious file to the vulnerable directory path. Once the malicious file is processed by Splunk, it can lead to arbitrary code execution in the context of the Splunk service.

The attack complexity is considered high due to the specific conditions required for successful exploitation, including user interaction. However, successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause is improper handling of temporary files within the $SPLUNK_HOME/var/run/splunk/apptemp directory. Splunk fails to implement adequate file isolation and validation mechanisms for files uploaded to this location, enabling privilege escalation through malicious file injection.

Attack Vector

The attack is network-based and requires authentication with a low-privileged account. An attacker must craft a malicious file designed to be executed when processed by Splunk's application handling routines. The attack vector involves:

1. Authenticating to the Splunk instance with a low-privileged user account
2. Uploading a malicious file to the $SPLUNK_HOME/var/run/splunk/apptemp directory
3. Triggering Splunk to process the malicious file, leading to code execution

The vulnerability manifests in the file upload and processing mechanism. For detailed technical information, refer to the Splunk Security Advisory SVD-2026-0403.

Detection Methods for CVE-2026-20204

Indicators of Compromise

• Unexpected files appearing in the $SPLUNK_HOME/var/run/splunk/apptemp directory
• Unusual process spawning from Splunk service accounts
• Unauthorized file upload activity from low-privileged user accounts
• Anomalous execution patterns in Splunk application logs

Detection Strategies

• Monitor file system activity in the $SPLUNK_HOME/var/run/splunk/apptemp directory for suspicious file creations
• Implement file integrity monitoring (FIM) on the Splunk installation directories
• Review Splunk audit logs for file upload events from non-admin and non-power users
• Deploy endpoint detection rules to identify unusual child processes spawned by Splunk services

Monitoring Recommendations

• Enable verbose logging for file operations within Splunk directories
• Configure SIEM alerts for file creation events in the apptemp directory
• Establish baseline behavior for Splunk service processes to detect anomalous execution
• Monitor network connections from Splunk services for unexpected outbound communications

How to Mitigate CVE-2026-20204

Immediate Actions Required

• Upgrade Splunk Enterprise to versions 10.2.1, 10.0.5, 9.4.10, or 9.3.11 or later immediately
• Upgrade Splunk Cloud Platform to versions 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, or 9.3.2411.127 or later
• Review user accounts and restrict access to only necessary privileges
• Audit recent activity from low-privileged users for signs of exploitation attempts

Patch Information

Splunk has released security patches addressing this vulnerability. Detailed patch information is available in the Splunk Security Advisory SVD-2026-0403. Organizations should prioritize applying these updates to all affected Splunk Enterprise and Splunk Cloud Platform installations.

Workarounds

• Restrict file system permissions on the $SPLUNK_HOME/var/run/splunk/apptemp directory to limit write access
• Implement network segmentation to limit access to Splunk management interfaces
• Review and minimize the number of low-privileged user accounts with access to Splunk
• Consider implementing additional file upload validation controls at the network level

# Configuration example - Restrict apptemp directory permissions
chmod 750 $SPLUNK_HOME/var/run/splunk/apptemp
chown splunk:splunk $SPLUNK_HOME/var/run/splunk/apptemp
# Review current directory permissions
ls -la $SPLUNK_HOME/var/run/splunk/apptemp