CVE-2026-20240
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In Splunk Enterprise before versions 10.2.2, 10.0.5, 9.4.11, 9.3.12 and Splunk Cloud Platform before specified versions, a low-privileged user (without admin or power roles) can cause a denial of service (DoS) by exploiting the coldToFrozen.sh script in the splunk_archiver app to rename critical Splunk directories, making the instance non-functional.
Risk Assessment
This vulnerability allows an unprivileged user to disable a Splunk instance, potentially leading to disruptions in monitoring and data analysis services, impacting business continuity.
Recommendation
It is recommended to upgrade Splunk Enterprise to versions 10.2.2, 10.0.5, 9.4.11, or 9.3.12 (or later) and Splunk Cloud Platform to the appropriate versions listed in the description.
Original NVD description (English source)
In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could cause a Denial of Service by exploiting the `coldToFrozen.sh` script in the `splunk_archiver` app to rename critical Splunk directories, making the instance non-functional.<br><br>The Denial of Service is possible because of missing input validation in the `coldToFrozen.sh` script, which accepts arbitrary file paths and renames them without restricting operations to safe directories.