Review reviewHigh

CVE-2026-20297

Splunk Splunk Enterprise, Splunk Cloud Platform, splunk

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow, which does not restrict the installation path to the intended app directory.

CVSS: 7.2
EPSS: 0.48%
CISA KEV: Not listed
Published: 2026.07.16

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.48%

Technical severityCVSS 7.2

Vulnerability overview

Affected product and versions

Product: Splunk Splunk Enterprise, Splunk Cloud Platform, splunk
Affected versions: >= 10.4 < 10.4.1, >= 10.2 < 10.2.5, >= 10.0 < 10.0.8, >= 9.4 < 9.4.13, >= 9.3 < 9.3.14, >= 10.5.2605 < 10.5.2605.0, >= 10.4.2604 < 10.4.2604.6, >= 10.2.2510 < 10.2.2510.18, >= 10.1.2507 < 10.1.2507.24, >= 9.3.0 < 9.3.14, >= 9.4.0 < 9.4.13, >= 10.0.0 < 10.0.8, >= 10.2.0 < 10.2.5, 10.4.0
Fixed versions: 9.3.14, 9.4.13, 10.0.8, 10.2.5, 10.1.2507.24, 10.2.2510.18, 10.4.2604.6

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Splunk Splunk Enterprise, Splunk Cloud Platform, splunk and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-22