CVE-2026-20240

Published May 20, 2026

Last updated 2 months ago

CVSS medium 6.5

Splunk

Splunk Enterprise

Splunk Cloud Platform

Splunk Archiver

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-20240 describes a vulnerability found in Splunk Enterprise and Splunk Cloud Platform. This flaw stems from a missing input validation in the `coldToFrozen.sh` script, which is part of the `splunk_archiver` application. The script is designed to accept and rename arbitrary file paths without adequately restricting these operations to safe directories. Exploitation of this vulnerability allows a low-privileged user, who does not possess 'admin' or 'power' roles, to rename critical Splunk directories. This action can lead to a Denial of Service (DoS) condition, effectively making the Splunk instance non-functional.

Description: In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could cause a Denial of Service by exploiting the `coldToFrozen.sh` script in the `splunk_archiver` app to rename critical Splunk directories, making the instance non-functional.<br><br>The Denial of Service is possible because of missing input validation in the `coldToFrozen.sh` script, which accepts arbitrary file paths and renames them without restricting operations to safe directories.
Source: psirt@cisco.com
NVD status: Analyzed
Products: splunk, splunk_cloud_platform

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

psirt@cisco.com: CWE-20

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "22F3493D-997F-40A9-A5A9-4B4250603E8B",
            "versionEndExcluding": "9.3.12",
            "versionStartIncluding": "9.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "41BB20C9-CF42-4222-8664-74104A2D98E6",
            "versionEndExcluding": "9.4.11",
            "versionStartIncluding": "9.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "D5A01879-50A5-4266-A08C-F55584F442ED",
            "versionEndExcluding": "10.0.5",
            "versionStartIncluding": "10.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "9F3A147D-2A67-469A-A223-248DEFB413E0",
            "versionEndExcluding": "10.2.2",
            "versionStartIncluding": "10.2.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "ED26E5C7-F23C-4FB8-9B9C-509987065586",
            "versionEndExcluding": "9.3.2411.129",
            "versionStartIncluding": "9.3.2411",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D5C098C2-9ED5-41B4-BE57-984B71027144",
            "versionEndExcluding": "10.0.2503.13",
            "versionStartIncluding": "10.0.2503",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2C302734-E81B-49DE-B3D6-ACD20DD3A57A",
            "versionEndExcluding": "10.1.2507.21",
            "versionStartIncluding": "10.1.2507",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5F7423BE-EADA-4D07-A021-D0F9EBBF966F",
            "versionEndExcluding": "10.2.2510.11",
            "versionStartIncluding": "10.2.2510",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BECCFE49-3763-435F-B5E2-26A7546E17CB",
            "versionEndExcluding": "10.3.2512.9",
            "versionStartIncluding": "10.3.2512",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:10.4.2603:*:*:*:*:*:*:*",
            "matchCriteriaId": "C405F2EE-1E1E-45EA-ACB4-E5F5AE4811EB",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.