{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-08T00:12:45.023","vulnerabilities":[{"cve":{"id":"CVE-2026-20204","sourceIdentifier":"psirt@cisco.com","published":"2026-04-15T16:16:34.490","lastModified":"2026-10-26T21:10:00.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles could potentially perform a Remote Code Execution (RCE) by uploading a malicious file to the `$SPLUNK_HOME/var/run/splunk/apptemp` directory due to improper handling and insufficient isolation of temporary files within the `apptemp` directory."},{"lang":"es","value":"En las versiones de Splunk Enterprise anteriores a 10.2.1, 10.0.5, 9.4.10 y 9.3.11, y en las versiones de Splunk Cloud Platform anteriores a 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13 y 9.3.2411.127, un usuario con pocos privilegios que no posee los roles de Splunk ’admin’ o ’power’ podría potencialmente realizar una Ejecución Remota de Código (RCE) al cargar un archivo malicioso en el directorio ’$SPLUNK_HOME/var/run/splunk/apptemp’ debido a un manejo inadecuado y a un aislamiento insuficiente de los archivos temporales dentro del directorio ’apptemp’."}],"affected":[{"source":"psirt@cisco.com","affectedData":[{"vendor":"Splunk","product":"Splunk Enterprise","versions":[{"version":"10.2","lessThan":"10.2.1","versionType":"custom","status":"affected"},{"version":"10.0","lessThan":"10.0.5","versionType":"custom","status":"affected"},{"version":"9.4","lessThan":"9.4.10","versionType":"custom","status":"affected"},{"version":"9.3","lessThan":"9.3.11","versionType":"custom","status":"affected"}]},{"vendor":"Splunk","product":"Splunk Cloud Platform","versions":[{"version":"10.4.2603","lessThan":"Not Affected","versionType":"custom","status":"affected"},{"version":"10.3.2512","lessThan":"10.3.2512.5","versionType":"custom","status":"affected"},{"version":"10.2.2510","lessThan":"10.2.2510.9","versionType":"custom","status":"affected"},{"version":"10.1.2507","lessThan":"10.1.2507.19","versionType":"custom","status":"affected"},{"version":"10.0.2503","lessThan":"10.0.2503.13","versionType":"custom","status":"affected"},{"version":"9.3.2411","lessThan":"9.3.2411.127","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-15T00:00:00+00:00","id":"CVE-2026-20204","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-377"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"9.3.0","versionEndExcluding":"9.3.11","matchCriteriaId":"9A537203-F31B-44A1-BB9E-C62F4539FA0B"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"9.4.0","versionEndExcluding":"9.4.10","matchCriteriaId":"0205D102-93C7-42FA-A33E-E517BB7760C4"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.5","matchCriteriaId":"D5A01879-50A5-4266-A08C-F55584F442ED"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk:10.2.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"122C01E6-CD7E-44B3-BC65-2ACEDFE704E5"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*","versionStartIncluding":"9.3.2411","versionEndExcluding":"9.3.2411.127","matchCriteriaId":"6FCB2A3C-8069-4AAC-8746-4B9679DE8116"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.2503","versionEndExcluding":"10.0.2503.13","matchCriteriaId":"D5C098C2-9ED5-41B4-BE57-984B71027144"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*","versionStartIncluding":"10.1.2507","versionEndExcluding":"10.1.2507.19","matchCriteriaId":"2490F8A7-7B04-4E40-9414-02C050DAEB10"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*","versionStartIncluding":"10.2.2510","versionEndExcluding":"10.2.2510.9","matchCriteriaId":"7C32CC18-1AF2-42B7-B4BF-D0E251BD8BDC"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*","versionStartIncluding":"10.3.2512","versionEndExcluding":"10.3.2512.5","matchCriteriaId":"D8346F9C-302C-455A-9BE3-82C7C261830B"}]}]}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2026-0403","source":"psirt@cisco.com","tags":["Vendor Advisory"]}]}}]}