Splunk Enterprise and Cloud Platform Exposed to Dangerous RCE Vulnerability

Splunk has disclosed a high-severity vulnerability affecting both its Enterprise and Cloud Platform environments. Tracked as CVE-2026-20204, this flaw allows attackers to execute arbitrary code remotely.

With a CVSS score of 7.1, the vulnerability requires immediate attention from system administrators and security threat hunters.

Vulnerability Details

The security defect stems from the improper handling and insufficient isolation of specific temporary files within Splunk Web. According to the advisory released on April 15, 2026, the issue is formally classified under CWE-377.

The core of the problem lies in the SPLUNK_HOME/var/run/splunk/apptemp directory path. A low-privileged user, specifically one who does not hold the “admin” or “power” roles within Splunk, can exploit this weakness by uploading a maliciously crafted file to this temporary folder. If successfully executed, this leads to Remote Code Execution (RCE).

While the attack requires the threat actor to have some level of authenticated access to the system, the fact that a standard, low-level account can trigger an RCE makes it highly dangerous.

This capability means that a minor compromise of an account could easily lead to a complete server takeover. Splunk security researcher Gabriel Nitu is credited with discovering and reporting this flaw.

Organizations must immediately audit their environments to determine if they are running a vulnerable instance. The flaw impacts multiple versions of Splunk Web across different product lines.

Splunk Enterprise environments are affected on the following version paths:

• Version 10.2: Specifically, version 10.2.0 is vulnerable.
• Version 10.0: Versions spanning from 10.0.0 through 10.0.4.
• Version 9.4: Versions spanning from 9.4.0 through 9.4.9.
• Version 9.3: Versions spanning from 9.3.0 through 9.3.10.

Splunk Cloud Platform environments are also exposed on these builds:

• Version 10.3.2512: All builds below 10.3.2512.5.
• Version 10.2.2510: All builds below 10.2.2510.9.
• Version 10.1.2507: All builds below 10.1.2507.19.
• Version 10.0.2503: All builds below 10.0.2503.13.
• Version 9.3.2411: All builds below 9.3.2411.127.

Please note that Splunk Cloud Platform version 10.4.2603 is fully secure and not affected by this vulnerability.

Mitigations and Patches

To protect critical infrastructure, Splunk urges administrators to update their software immediately. Enterprise users should upgrade to the patched versions: 10.2.1, 10.0.5, 9.4.10, or 9.3.11.

For Splunk Cloud Platform customers, the company is actively monitoring systems and rolling out patches to affected instances.

If upgrading is not immediately possible, there is a viable workaround. Because the vulnerability requires Splunk Web to be active, administrators can temporarily turn off the Splunk Web component.

This mitigation completely removes the attack surface until a proper patch can be applied. Security teams can achieve this by modifying the web.conf configuration file to turn off unnecessary web interface features.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.