Splunk Enterprise CVE-2026-20204

Exploitation requires a valid Splunk account that does not hold the admin or power role - a low-privileged authenticated user. The attacker must be able to write a file to the $SPLUNK_HOME/var/run/splunk/apptemp directory, which is the direct exploitation path. The CVSS UI:R metric confirms that a second party (another user or an automated Splunk process) must interact with or trigger execution of the malicious file after it is uploaded; the attack cannot complete without this trigger. High attack complexity (AC:H) indicates additional conditions must align - likely a specific timing, process state, or sequence of operations within the Splunk apptemp handling pipeline. Limiting factors: authentication is required (PR:L), the trigger condition must occur (UI:R), and the vulnerable directory must be accessible to the attacker's account, which depends on Splunk deployment configuration and filesystem permissions.

The CVSS 7.1 score with vector AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H reflects a meaningful but constrained real-world risk: while technical impact is total (all three pillars), the high attack complexity and required user interaction impose real barriers to exploitation. SSVC corroborates this - Automatable: no means mass exploitation is implausible, and Exploitation: none confirms no observed in-the-wild activity. The EPSS of 0.13% (33rd percentile) aligns with this low near-term exploitation probability. Splunk is widely deployed in enterprise SOC and SIEM environments, meaning a successful exploit yields high-value access - even a mid-sized municipal IT team in zabrze running Splunk as its primary log aggregation platform faces meaningful risk if a malicious insider or compromised low-privileged account can engineer the necessary trigger condition. The cisco-reported origin suggests the finding came from professional security research rather than active attacker discovery, further supporting the low EPSS signal. The mismatch between SSVC Technical Impact: total and the high-complexity/user-interaction prerequisites is the defining tension here: the theoretical ceiling is severe but the exploitation floor is high.

An attacker with a valid low-privileged Splunk account (lacking admin or power role) crafts a malicious file and uploads it to the $SPLUNK_HOME/var/run/splunk/apptemp directory via an exposed Splunk interface or API endpoint. A subsequent user interaction or Splunk process trigger causes the malicious file to be executed in the Splunk process context, yielding code execution on the underlying server. No public proof-of-concept code has been identified, and the required user interaction makes fully automated exploitation infeasible.