CVE-2026-20204
Splunk Cloud Platform 9.3.2411 – 9.3.2411.127
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2026-20204 is a high-severity Insecure Temporary File (CWE-377) vulnerability in Splunk Splunk Cloud Platform. Its CVSS base score is 7.1 (High).
Operationally, ranked in the top 13% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20204 is a remote code execution (RCE) vulnerability affecting Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, as well as Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127. The flaw arises from improper handling and insufficient isolation of temporary files within the $SPLUNK_HOME/var/run/splunk/apptemp directory, classified under CWE-377 (Insecure Temporary File). It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) and was published on 2026-04-15.
A low-privileged Splunk user lacking admin or power roles can exploit this vulnerability remotely by uploading a malicious file to the apptemp directory. Successful exploitation enables arbitrary code execution on the affected system, with high impacts on confidentiality, integrity, and availability. The attack requires network access, high complexity, low privileges, and user interaction.
The Splunk advisory at https://advisory.splunk.com/advisories/SVD-2026-0403 provides details on mitigation, including upgrades to the fixed versions listed above.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22934
Vulnerability Data
In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles could potentially perform a…
more
Remote Code Execution (RCE) by uploading a malicious file to the `$SPLUNK_HOME/var/run/splunk/apptemp` directory due to improper handling and insufficient isolation of temporary files within the `apptemp` directory.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces file-system access authorizations so that temporary files cannot be read or modified by unauthorized processes.
AC-6 reduces the privileges available to processes that create or access temporary files, limiting blast radius if a file is predictable or left readable.
SC-4 directly stops unauthorized information leakage through shared resources such as world-writable temporary directories.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require avoiding insecure temp-file creation patterns.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect insecure temporary files but does not prevent their creation.
Secure development life cycle mandates secure handling of temporary files during design and coding.
Application security requirements can specify secure temporary-file creation and access controls.
Secure system architecture principles discourage insecure temporary-file patterns but do not directly address them.
Secure coding standards explicitly require safe temporary-file APIs and permissions.
Information deletion policies may cover secure removal of temporary files after use.