Splunk CVE-2026-20204

We need to parse the CVE data and synthesize into the required JSON fields. Let's go through each field.

• product_name: 1-3 words. Affected products are Splunk Enterprise and Splunk Cloud Platform. The primary product could be "Splunk Enterprise" as the most common on-prem product, but description lists both. We can say "Splunk Enterprise" or "Splunk Cloud Platform". Since the vulnerability is in the apptemp directory handling and it's a low-privileged user with RCE, I'll pick "Splunk Enterprise" as the core product name. However, "Splunk" alone might be too generic, but allowed 1-3 words. So "Splunk Enterprise" is fine.
• summary: 2-3 sentences plain-language, not copy of description. Must start with impact verb. Impact is RCE, so something like "Remote code execution in Splunk Enterprise and Splunk Cloud Platform allows...". Specific: low-privileged user (not admin/power) uploads malicious file to apptemp directory due to improper handling, leading to RCE. Affected versions: Enterprise below 10.2.1, 10.0.5, 9.4.10, 9.3.11; Cloud below various versions. Attacker can execute arbitrary code. EPSS low (0.13%), no KEV, no POC mentioned? Tags don't say POC. SSVC says exploitation none, automatable no, total impact. So not actively exploited. Summary: "Remote code execution in Splunk Enterprise and Splunk Cloud Platform allows low-privileged users without admin/power roles to execute arbitrary code by uploading a malicious file to the $SPLUNK_HOME/var/run/splunk/apptemp directory. Affects Enterprise versions before 9.3.11, 9.4.10, 10.0.5, 10.2.1 and Cloud Platform before respective fixed versions. No public exploit identified at time of analysis."
• technical_context: underlying technology/protocol: Splunk apptemp directory is a temporary file storage used during app installation or updates. CWE-377 is Insecure Temporary File handling. The root cause is insufficient isolation: files in apptemp can be manipulated by low-privileged users to achieve RCE. CPEs indicate both Splunk Enterprise and Cloud Platform. Could explain that Splunk uses this directory for app staging, and improper handling of file permissions allows malicious upload to trigger code execution, possibly through app validation or loading mechanisms. Educational.
• risk_assessment: CVSS 7.1, vector AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. So network attack, high complexity, low privileges required, user interaction required, scope unchanged, high impact on CIA. EPSS 0.13% (low probability of exploitation, 33rd percentile). Not in KEV. No POC evidence. SSVC: exploitation none, automatable no, technical impact total. So risk is moderate but not actively exploited. Complexity high and user interaction required reduce real-world risk. But total impact, so if exploited, serious. Compare: CVSS is high severity (7.1) but EPSS suggests low exploitation likelihood. Patches available. Real-world priority: apply patches as part of normal cadence, not emergency. Mention that despite low EPSS, the total impact makes it worth remediating.
• affected_products: list products with version ranges. Splunk Enterprise: below 10.2.1, 10.0.5, 9.4.10, 9.3.11. Splunk Cloud Platform: below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, 9.3.2411.127. Reference to vendor advisory: https://advisory.splunk.com/advisories/SVD-2026-0403. No bullet points.
• remediation: action: upgrade to fixed versions. Provide exact versions: Enterprise: 9.3.11, 9.4.10, 10.0.5, 10.2.1; Cloud: 9.3.2411.127, 10.0.2503.13, 10.1.2507.19, 10.2.2510.9, 10.3.2512.5, 10.4.2603.0. Workaround maybe not mentioned. Possibly restrict file upload permissions or restrict access to apptemp directory. But no specific workaround in description. I'll say: "Upgrade Splunk Enterprise to version 9.3.11, 9.4.10, 10.0.5, or 10.2.1, and Splunk Cloud Platform to 9.3.2411.127, 10.0.2503.13, 10.1.2507.19, 10.2.2510.9, 10.3.2512.5, or 10.4.2603.0. As a temporary mitigation if upgrading is not possible, restrict write access to the apptemp directory to trusted roles only, but this may impact app installation functionality. Consult advisory SVD-2026-0403."
• exploit_scenario: realistic attack: low-privileged Splunk user (without admin/power) uploads a malicious file to the apptemp directory (which they can access) via a crafted request or through app upload functionality if allowed; the file is then processed by Splunk in a way that leads to code execution, potentially via loading a malicious app or configuration. Attack complexity high due to need to trigger processing. Example: "A low-privileged user authenticates to Splunk Web and uploads a specially crafted file to the apptemp directory via the app import feature. When Splunk processes the temporary file for app installation, the malicious payload executes, giving the attacker remote code execution on the Splunk server."
• exploitation_conditions: specific prerequisites from description: "low-privileged user that does not hold the admin or power Splunk roles". So attacker must have any low-privileged role, not power/admin. Also, the user must be able to upload a file to the $SPLUNK_HOME/var/run/splunk/apptemp directory. That directory might be writable by all authenticated users? The vulnerability is due to improper handling and insufficient isolation of temporary files. So condition: the Splunk instance must allow file uploads to apptemp by low-privileged users. It may be default. User interaction required (UI:R) could refer to the attacker needing to trick a user into processing? Actually UI:R in CVSS means the attacker must trick a user into taking some action. This might be that the low-privileged user must upload the file, but it's the attacker that is that user. In that case, it's not UI. Wait, CVSS says UI:R, which typically requires that the exploitation requires a user other than the attacker to take action. Could be that the attacker needs to convince a victim (another user) to upload the malicious file? The description says "a low-privileged user could potentially perform a Remote Code Execution by uploading a malicious file". That suggests the attacker is the low-privileged user themselves. So UI:R might be misinterpreted? Alternatively, the upload might be via some UI action that the attacker performs. But CVSS defines UI:R as "the vulnerable component requires user interaction to function. ... the user interaction is required from a user other than the attacker." So if the attacker themselves is the user performing the upload, then it's not UI:R but rather PR:L and no UI. The CVSS vector provided shows UI:R, but given descriptions, maybe the attacker must convince a user with low privileges to upload? Could be both: maybe the attacker can be a low-privileged user, but to trigger the RCE they need to interact with the apptemp directory in a way that involves some UI? Possibly the vulnerability is in the handling of uploaded files during app installation, which might be triggered by the user through UI. I think the vector might be AV:N/AC:H/PR:L/UI:N/..., but they put UI:R. I'll respect the given CVSS vector. So exploitation conditions: attacker must be authenticated as a low-privileged user (non-admin, non-power) and must be able to upload a file to apptemp, but also requires user interaction from another user? Perhaps the attacker uploads a file that is then executed when an admin installs or processes an app. That would be UI:R from the admin. So condition: "Exploitation requires an authenticated low-privileged user (without admin or power roles) to upload a malicious file to the apptemp directory, and a subsequent user action (e.g., by an administrator or automated process) that triggers processing of that file." But let's keep to the description. I'll state: "Requires an authenticated Splunk account with any low-privileged role (not admin or power). The attacker must be able to write files to the $SPLUNK_HOME/var/run/splunk/apptemp directory, which may be accessible by default. User interaction is required to trigger the RCE (CVSS UI:R), likely from another user such as an administrator performing an app management action." Also add that it's remote over network. So: "Exploitation requires authenticated access as a low-privileged user (non-admin, non-power) and the ability to upload files to the apptemp directory. No specific non-default configuration is required if the directory is writable; however, the high attack complexity and user interaction requirement imply that the attacker must either trick another user into processing the file or rely on specific workflow."
• attack_chain: Based on kill chain: authenticated low-privileged user uploads malicious file to apptemp directory via Splunk Web or API → file is stored in apptemp with insufficient isolation → later, an administrator or cron job processes the file (e.g., during app installation or validation) → the malicious payload executes → attacker achieves remote code execution with Splunk service privileges. So chain: "Authenticate as low-privileged Splunk user → Upload malicious file to apptemp directory via app upload feature → Wait for file to be processed by Splunk (e.g., admin action or scheduled task) → Malicious code executes → Gain RCE on Splunk server." 5 steps.
• confidence_notes: Vendor advisory exists (SVD-2026-0403) confirming affected versions and patches. EPSS score is low, no KEV. POC status unknown (not listed). The CVE description is from the advisory. SSVC indicates no exploitation, not automatable, total impact. So confidence: "Vendor-confirmed vulnerability with fixed versions published in Splunk advisory SVD-2026-0403. No evidence of public exploit or active exploitation. Affected version ranges and patch availability are confirmed. The exact mechanism of code execution and preconditions (UI:R) require further analysis."
• prevalence: Splunk is a widely used enterprise SIEM and log management platform. It is common in large organizations. So prevalence likely "high". Many enterprise environments run Splunk. So "high".
• prevalence_basis: "widely deployed enterprise SIEM and log management solution".
• assessed_cvss_vector: I need to provide my own independent CVSS. Given the description, I might adjust. The provided CVSS is 7.1: AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. Is that reasonable? The attack requires network, low privileges, but also user interaction. However, if the attacker is the low-privileged user and they upload a file and that immediately triggers RCE, then UI:N would be more appropriate. But the description doesn't say what triggers the RCE. Could be that the file is uploaded and then automatically processed by some Splunk internal mechanism without user interaction? The CWE-377 is Insecure Temporary File, but the vulnerability could be that the file is placed and then later processed by a service (like a cron job) that doesn't require user interaction. In that case, UI:N. However, the given vector has UI:R, which I'll respect because it's from Splunk themselves. So my assessed vector might differ. I'll reason: The attack requires the attacker to upload a file, but if the processing is automatic, then UI:N. But high complexity maybe due to file format or timing. I'll lean towards UI:N if the description doesn't mention tricking a user. But let's read: "could potentially perform a Remote Code Execution by uploading a malicious file to the $SPLUNK_HOME/var/run/splunk/apptemp directory due to improper handling". So the act of uploading is the vector. The handling is improper, so the mere upload might cause RCE. That suggests no additional user interaction. So I'd set UI:N. Also, the attack complexity: maybe needs specific file content? High? Might be high if