Splunk fixes flaws enabling file write, information disclosure, and low-privilege RCE

Splunk disclosed and patched multiple vulnerabilities affecting Splunk Enterprise, Splunk Cloud Platform, and the MCP Server application, including two high-severity issues in its core platforms. The most serious, CVE-2026-20204, could allow a low-privileged user to achieve remote code execution by uploading a malicious file into the temporary application directory at $SPLUNK_HOME/var/run/splunk/apptemp, a weakness tied to improper temporary-file handling and insufficient isolation. Italian authorities also warned that newly identified flaws in Splunk products could expose sensitive information and allow arbitrary file writes on affected systems, urging organizations to review impacted version branches and apply vendor fixes.