CVEFinder.io

CVE-2026-20240

🔶 medium
🔍 Scan for this CVE
Summary

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could cause a Denial of Service by exploiting the `coldToFrozen.sh` script in the `splunk_archiver` app to rename critical Splunk directories, making the instance non-functional.<br><br>The Denial of Service is possible beca

Description

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could cause a Denial of Service by exploiting the `coldToFrozen.sh` script in the `splunk_archiver` app to rename critical Splunk directories, making the instance non-functional.<br><br>The Denial of Service is possible because of missing input validation in the `coldToFrozen.sh` script, which accepts arbitrary file paths and renames them without restricting operations to safe directories.

CVSS Score
6.5
Medium
EPSS Score
0.4
Exploit Probability
Published Date
2026-05-20
First Seen: 2026-05-21
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 46.8% of all 349,016 vulnerabilities in our database.

#185,675
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 20, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
Alex Hordijk (hordalex)
SSVC data provided by CISA
Last Modified 2026-07-23
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)
CWE-20

📦 Affected Products 10

Vendor Product Status Affected Versions
splunk splunk Affected
> 10.0.0 < 10.0.5
splunk splunk Affected
> 10.2.0 < 10.2.2
splunk splunk Affected
> 9.3.0 < 9.3.12
splunk splunk Affected
> 9.4.0 < 9.4.11
splunk splunk_cloud_platform Affected
> 10.0.2503 < 10.0.2503.13
splunk splunk_cloud_platform Affected
> 10.1.2507 < 10.1.2507.21
splunk splunk_cloud_platform Affected
> 10.2.2510 < 10.2.2510.11
splunk splunk_cloud_platform Affected
> 10.3.2512 < 10.3.2512.9
splunk splunk_cloud_platform Affected
> 9.3.2411 < 9.3.2411.129
splunk splunk_cloud_platform Affected
v10.4.2603

🔗 References 1

https://advisory.splunk.com/advisories/SVD-2026-0504
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-76251 ⚠️ high 7.1 0.2 In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk r... 2026-08-19
CVE-2026-76252 🔶 medium 6.8 0.2 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user ... 2026-08-19
CVE-2026-76253 ⚠️ high 8.8 0.4 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_searc... 2026-08-19
CVE-2026-76254 ⚠️ high 7.5 0.3 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause anot... 2026-08-19
CVE-2026-76255 🔶 medium 6.4 0.2 In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" ... 2026-08-19
CVE-2026-76256 🔶 medium 4.3 0.2 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9,... 2026-08-19
These CVEs affect the same products