Splunk RCE: Low-Privilege Users Could Gain Remote Code Execution

April 15, 2026 19:16 /HIGH

SCW vulnerabilitycvehigh-severityremote-code-executioncwe-377

Splunk RCE: Low-Privilege Users Could Gain Remote Code Execution

The National Vulnerability Database (NVD) has detailed a critical Remote Code Execution (RCE) vulnerability, CVE-2026-20204, affecting multiple versions of Splunk Enterprise and Splunk Cloud Platform. This flaw, rated with a CVSS score of 7.1 (HIGH), allows a low-privileged user – specifically, one without admin or power roles – to execute arbitrary code remotely.

According to the NVD, the vector involves uploading a malicious file to the $SPLUNK_HOME/var/run/splunk/apptemp directory. The root cause is identified as improper handling and insufficient isolation of temporary files within this apptemp directory (CWE-377). This means even basic users could potentially weaponize the system, turning a seemingly benign file upload into a full-blown RCE.

Related ATT&CK Techniques

T1190 Exploit Public-Facing Application Initial Access T1068 Exploitation for Privilege Escalation Privilege Escalation T1505.003 Server Software Component: Exploit Initial Access

🛡️ Detection Rules

7 rules · 6 SIEM formats

7 auto-generated detection rules for this incident, mapped to MITRE ATT&CK. Available in Sigma, Splunk SPL, Sentinel KQL, Elastic Lucene, QRadar AQL, and Wazuh.

high T1190 Initial Access

Web Application Exploitation Attempt — CVE-2026-20204

✓ Sigma 🔒 Splunk SPL 🔒 Sentinel KQL 🔒 Elastic 🔒 QRadar AQL 🔒 Wazuh

Want this in your SIEM's native format? Get Splunk SPL, Sentinel KQL, Elastic, QRadar AQL, or Wazuh — ready to paste.

7 Sigma rules mapped to the ATT&CK techniques from this breach — pick your SIEM and get a ready-to-paste query.

Get All SIEM Formats →

Indicators of Compromise

ID	Type	Indicator
CVE-2026-20204	RCE	Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, 9.3.11
CVE-2026-20204	RCE	Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, 9.3.2411.127
CVE-2026-20204	RCE	Vulnerable component: improper handling and insufficient isolation of temporary files within the `apptemp` directory
CVE-2026-20204	RCE	Attack vector: uploading a malicious file to the `$SPLUNK_HOME/var/run/splunk/apptemp` directory

By Shimi's Cyber World Editorial

Related ATT&CK Techniques

🛡️ Detection Rules

Web Application Exploitation Attempt — CVE-2026-20204

Indicators of Compromise

Related Posts

Velociraptor Vulnerability Exposes Multi-Org Data

CVE-2026-33214 — Weblate is a web based localization tool. In versions prior

Git for Windows NTLM Hash Leak Poses Credential Risk