Brief Summary: Splunk Enterprise CVE-2026-20204 Remote Code Execution via Temporary File Upload

Introduction

A low-privileged user on a Splunk deployment can achieve remote code execution by uploading a malicious file to a temporary directory. This is the second time in roughly a year that this exact attack surface has been disclosed. CVE-2026-20204 affects both Splunk Enterprise and Splunk Cloud Platform and has a CVSS score of 7.1. It closely resembles CVE-2025-20229 from March 2025, which matters most to defenders who thought the issue was already resolved.

Technical Information

The vulnerability lies in how Splunk handles temporary files in the $SPLUNK_HOME/var/run/splunk/apptemp directory. Splunk uses this directory during application management operations, and the flaw is classified under CWE-377: Insecure Temporary File.

Temporary files in the apptemp directory are handled improperly and isolated insufficiently. Splunk does not adequately restrict which users can write files to this location, and it does not properly validate or sandbox the contents of uploaded files. As a result, a user holding only a low-privilege Splunk role (anything below admin or power) can place a malicious file into this directory.

Attack Flow

The exploitation path is straightforward, which makes the risk worse:

1. The attacker authenticates to the Splunk instance with any valid low-privilege account. No admin or power role is required.
2. The attacker crafts a malicious file designed for code execution within the Splunk runtime environment.
3. The attacker uploads this file to the $SPLUNK_HOME/var/run/splunk/apptemp directory. The insufficient access controls and file isolation on this path allow the upload.
4. Because Splunk handles temporary files improperly, it processes or executes the uploaded payload, and the attacker gains remote code execution on the underlying system.

Preconditions

Exploitation requires Splunk Web to be turned on, because the file upload goes through the web interface. If Splunk Web is disabled, this particular vector is not reachable.

Workaround

For organizations that cannot upgrade immediately, Splunk recommends turning off Splunk Web as a temporary mitigation. Administrators should follow Splunk's documentation on disabling unnecessary components to make this change.

The permanent fix is to upgrade to one of the fixed versions listed below.

Affected Systems and Versions

Splunk Enterprise

All versions below the following are vulnerable:

Splunk Cloud Platform

All versions below the following are vulnerable:

The vulnerability is exploitable only when Splunk Web is enabled. Deployments with the web interface disabled are not affected by this specific attack vector.

Vendor Security History

This vulnerability has a precedent. In March 2025, Splunk disclosed SVD-2025-0301, tracked as CVE-2025-20229. That vulnerability allowed a low-privileged user without admin or power roles to perform remote code execution through a file upload to the exact same directory, $SPLUNK_HOME/var/run/splunk/apptemp.

The attack vector, the privilege requirements, and the target directory are all identical between the 2025 and 2026 variants. This recurrence strongly suggests that either the original fix for CVE-2025-20229 was incomplete or the underlying architectural issue in how Splunk manages the apptemp directory was not fully addressed.

Splunk has operated under Cisco since the completed acquisition in March 2024, and it was named a Leader in the 2025 Gartner Magic Quadrant for SIEM for the eleventh consecutive time. A vendor with substantial resources and market credibility has now shipped this specific vulnerability class twice, and that is worth monitoring closely.

References

• SVD-2026-0403: Splunk Vulnerability Disclosure (Official Advisory)
• SVD-2025-0301: Prior Splunk Vulnerability Disclosure for CVE-2025-20229
• CVE-2025-20229 Detail at NVD
• Splunk Documentation: Disable Unnecessary Splunk Enterprise Components
• Cisco Completes Acquisition of Splunk
• Cisco and Splunk Acquisition Overview
• Splunk Named Leader in 2025 Gartner SIEM Report
• Splunk Analyst Recognition (Cisco Investor Relations)