Loading vulnerability…
Remote Code Execution in Splunk Enterprise and Splunk Cloud Platform apptemp Handling
CVE-2026-20204 is a high-severity remote code execution vulnerability affecting Splunk Enterprise and Splunk Cloud Platform. The flaw is caused by improper handling and insufficient isolation of temporary files within Splunk’s application temporary directory. A low-privileged authenticated Splunk user who does not hold the admin or power roles can upload a malicious file into the apptemp area, where it may be processed in a manner that results in code execution on the underlying host. The issue is associated with insecure temporary file handling in the Splunk Web attack surface and affects Splunk Enterprise versions earlier than 10.2.1, 10.0.5, 9.4.10, and 9.3.11, as well as Splunk Cloud Platform versions earlier than 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow execution of arbitrary code on the affected Splunk host in the context available to the vulnerable service or component. This can enable full compromise of the Splunk instance, unauthorized modification of data or configuration, deployment of additional payloads, persistence, and potential follow-on activity against connected systems or managed environments.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable Splunk Web to remove the documented attack path. Restrict access to Splunk accounts with low privileges, review role assignments, and limit exposure of the web interface until fixed versions are deployed.
Patch, then assume compromise.
Upgrade Splunk Enterprise to a fixed release: 10.2.1 or later, 10.0.5 or later, 9.4.10 or later, or 9.3.11 or later, according to the deployed branch. For Splunk Cloud Platform, apply the fixed builds 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, or 9.3.2411.127, or later as applicable. In Splunk Cloud environments, the platform operator may apply the required updates directly.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.