CVEFinder.io

CVE-2026-20240

🔶 medium
🔍 Scan for this CVE
Summary

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could cause a Denial of Service by exploiting the `coldToFrozen.sh` script in the `splunk_archiver` app to rename critical Splunk directories, making the instance non-functional.<br><br>The Denial of Service is possible beca

Description

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could cause a Denial of Service by exploiting the `coldToFrozen.sh` script in the `splunk_archiver` app to rename critical Splunk directories, making the instance non-functional.<br><br>The Denial of Service is possible because of missing input validation in the `coldToFrozen.sh` script, which accepts arbitrary file paths and renames them without restricting operations to safe directories.

CVSS Score
6.5
Medium
EPSS Score
0.4
Exploit Probability
Published Date
2026-05-20
First Seen: 2026-05-21
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 47.0% of all 342,933 vulnerabilities in our database.

#181,622
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 20, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
Alex Hordijk (hordalex)
SSVC data provided by CISA
Last Modified 2026-07-23
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)
CWE-20

📦 Affected Products 10

Vendor Product Status Affected Versions
splunk splunk Affected
> 10.0.0 < 10.0.5
splunk splunk Affected
> 10.2.0 < 10.2.2
splunk splunk Affected
> 9.3.0 < 9.3.12
splunk splunk Affected
> 9.4.0 < 9.4.11
splunk splunk_cloud_platform Affected
> 10.0.2503 < 10.0.2503.13
splunk splunk_cloud_platform Affected
> 10.1.2507 < 10.1.2507.21
splunk splunk_cloud_platform Affected
> 10.2.2510 < 10.2.2510.11
splunk splunk_cloud_platform Affected
> 10.3.2512 < 10.3.2512.9
splunk splunk_cloud_platform Affected
> 9.3.2411 < 9.3.2411.129
splunk splunk_cloud_platform Affected
v10.4.2603

🔗 References 1

https://advisory.splunk.com/advisories/SVD-2026-0504
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-20296 ⚠️ high 8.3 0.2 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.26... 2026-07-15
CVE-2026-20297 ⚠️ high 7.2 0.5 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below... 2026-07-15
CVE-2026-20298 🔶 medium 5.3 0.2 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.26... 2026-07-15
CVE-2026-20251 ⚠️ high 8.8 0.6 In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.1... 2026-06-10
CVE-2026-20252 ⚠️ high 7.6 0.3 In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.26... 2026-06-10
CVE-2026-20253 ⛔ critical 9.8 96.2 In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or tr... 2026-06-10
These CVEs affect the same products