Loading vulnerability…
Denial of Service in Splunk splunk_archiver coldToFrozen.sh
CVE-2026-20240 is an improper input validation vulnerability in the Splunk Archiver application affecting Splunk Enterprise and Splunk Cloud Platform. The flaw resides in the coldToFrozen.sh script used for data archiving and lifecycle operations. The script accepts arbitrary file path input and performs rename operations without adequately restricting those operations to intended safe directories. A low-privileged authenticated user who does not hold the admin or power Splunk roles can abuse this behavior to rename critical Splunk directories. Renaming those directories can break internal database mappings and core application directory structure, causing the Splunk instance to become non-functional.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes a denial-of-service condition. An attacker can render the affected Splunk instance inoperable by renaming critical directories required for normal platform operation. The result is loss of availability of the Splunk service and disruption of logging, search, and analytics functions on the affected instance.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable the Splunk Archiver application as a temporary workaround, particularly where the archiving functionality is not required. Restrict low-privileged user access to functionality that can invoke the vulnerable script until patched.
Patch, then assume compromise.
Upgrade affected products to fixed releases. Affected Splunk Enterprise versions are fixed in 10.2.2, 10.0.5, 9.4.11, and 9.3.12 or later. Affected Splunk Cloud Platform versions are fixed in 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.