Denial of Service Vulnerability in Splunk Enterprise and Splunk Cloud Platform

CVE-2026-20240

What is CVE-2026-20240?

In specific versions of Splunk Enterprise and Splunk Cloud Platform, a vulnerability exists within the 'coldToFrozen.sh' script of the 'splunk_archiver' app. This vulnerability allows a low-privileged user to exploit lack of input validation, leading to the renaming of critical directories within Splunk. As a result, this can cause the instance to become non-functional due to a Denial of Service condition. The risk is heightened as unauthorized users can manipulate file paths, which may compromise the stability and availability of the Splunk services.

References