CVE-2026-20204

CVE-2026-20204 is a remote code execution vulnerability affecting Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, as well as Splunk Cloud Platform versions below 10.4.2603.0 and several earlier release branches. The vulnerability stems from improper handling and insufficient isolation of temporary files in the $SPLUNK_HOME/var/run/splunk/apptemp directory, allowing low-privileged users without admin or power roles to upload malicious files and achieve code execution. The vulnerability carries a CVSS score of 7.1 (HIGH) with a network-based attack vector requiring high attack complexity and low-privilege user interaction. The potential impact is severe, encompassing complete compromise of confidentiality, integrity, and availability. However, the EPSS score of 0.00184 indicates this vulnerability ranks below the median threat across all CVEs, suggesting relatively lower real-world exploitability despite its technical severity. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. The FAUCET risk score of 47.0 out of 100 and inactive hot list status further indicate minimal community attention and exploitation activity at present. Organizations should prioritize patching based on asset exposure rather than immediate exploitation pressure, though prompt updates to affected versions are still recommended.