EUVD-2026-22934Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Network-reachable upload path, but AC:H for required trigger condition, PR:L for authenticated low-priv account, and UI:R for necessary interaction to execute the payload.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the admin or power Splunk roles could potentially perform a Remote Code Execution (RCE) by uploading a malicious file to the $SPLUNK_HOME/var/run/splunk/apptemp directory due to improper handling and insufficient isolation of temporary files within the apptemp directory.
AnalysisAI
Remote code execution in Splunk Enterprise and Splunk Cloud Platform is achievable by low-privileged users - those without the admin or power role - by uploading a malicious file to the $SPLUNK_HOME/var/run/splunk/apptemp directory, exploiting insufficient isolation of temporary files (CWE-377). Affected versions span Splunk Enterprise below 10.2.1/10.0.5/9.4.10/9.3.11 and multiple Splunk Cloud Platform release trains. No public exploit code has been identified and CISA has not listed this in KEV; SSVC assigns Exploitation: none and Automatable: no, indicating low immediate threat despite total technical impact.
Technical ContextAI
The vulnerability is rooted in CWE-377 (Insecure Temporary File), specifically improper handling and insufficient isolation of the apptemp temporary directory at $SPLUNK_HOME/var/run/splunk/apptemp. Splunk Enterprise and Splunk Cloud Platform (CPE: cpe:2.3:a:splunk:splunk_enterprise and cpe:2.3:a:splunk:splunk_cloud_platform) process app-related temporary artifacts in this directory. The isolation controls governing which users can write to this directory and how those files are subsequently processed or executed are deficient, allowing a low-privileged platform user to plant a malicious file that the Splunk process later acts upon. The CVSS vector (AC:H, UI:R) indicates the exploitation path requires a specific triggering condition - likely an authorized user or automated Splunk process handling a file in that directory after the malicious upload, rather than a purely autonomous exploit chain.
RemediationAI
Upgrade Splunk Enterprise to version 10.2.1, 10.0.5, 9.4.10, or 9.3.11 (or later) depending on the active release branch. For Splunk Cloud Platform, upgrade to 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, or 9.3.2411.127 as applicable; note that Splunk Cloud Platform 10.4.2603 is listed as Not Affected. Full vendor guidance is at https://advisory.splunk.com/advisories/SVD-2026-0403. As a compensating control prior to patching, restrict filesystem-level write access to $SPLUNK_HOME/var/run/splunk/apptemp so that only the Splunk service account can write to this directory - this directly addresses the upload vector but may interfere with legitimate app staging workflows and should be tested in non-production first. Additionally, enforce the principle of least privilege by auditing which accounts hold low-privileged Splunk roles and removing unnecessary access.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an atta
Same weakness CWE-377 – Insecure Temporary File
View allShare
External POC / Exploit Code
Leaving vuln.today