CVE-2026-20240
Analyzed Analyzed - Analysis Complete
Denial of Service in Splunk Enterprise via coldToFrozen.sh

Publication date: 2026-05-20

Last updated on: 2026-05-21

Assigner: Cisco Systems, Inc.

Description
In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129, a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could cause a Denial of Service by exploiting the `coldToFrozen.sh` script in the `splunk_archiver` app to rename critical Splunk directories, making the instance non-functional.<br><br>The Denial of Service is possible because of missing input validation in the `coldToFrozen.sh` script, which accepts arbitrary file paths and renames them without restricting operations to safe directories.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-20
Last Modified
2026-05-21
Generated
2026-06-10
AI Q&A
2026-05-20
EPSS Evaluated
2026-06-08
NVD
CVE-2026-20240
EUVD
EUVD-2026-31138
Affected Vendors & Products
Showing 10 associated CPEs
Vendor Product Version / Range
splunk splunk From 10.0.0 (inc) to 10.0.5 (exc)
splunk splunk From 10.2.0 (inc) to 10.2.2 (exc)
splunk splunk From 9.3.0 (inc) to 9.3.12 (exc)
splunk splunk From 9.4.0 (inc) to 9.4.11 (exc)
splunk splunk_cloud_platform From 10.0.2503 (inc) to 10.0.2503.13 (exc)
splunk splunk_cloud_platform From 10.1.2507 (inc) to 10.1.2507.21 (exc)
splunk splunk_cloud_platform From 10.2.2510 (inc) to 10.2.2510.11 (exc)
splunk splunk_cloud_platform From 10.3.2512 (inc) to 10.3.2512.9 (exc)
splunk splunk_cloud_platform From 9.3.2411 (inc) to 9.3.2411.129 (exc)
splunk splunk_cloud_platform 10.4.2603
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-20240 is a high-severity vulnerability in Splunk Enterprise and Splunk Cloud Platform that allows a low-privileged user without admin or power roles to cause a Denial of Service (DoS).

The vulnerability exists because the coldToFrozen.sh script in the splunk_archiver app lacks proper input validation, allowing arbitrary file path renaming. This can disrupt critical Splunk directories and make the instance non-functional.

Affected versions include Splunk Enterprise below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, as well as Splunk Cloud Platform below specific patch levels.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) on your Splunk instance by allowing a low-privileged user to rename critical directories, rendering the system non-functional.

If exploited, it disrupts the normal operation of Splunk, potentially causing downtime and loss of access to important data and services.

Mitigation involves upgrading to patched versions or disabling the splunk_archiver app, though disabling the app stops automated cold-to-frozen bucket transitions.

If the splunk_archiver app is unused, the impact is minimal.

Detection Guidance

Detection of this vulnerability involves identifying if the affected versions of Splunk Enterprise or Splunk Cloud Platform are in use and whether the splunk_archiver app is installed and active.

You can check the Splunk version by running the following command on the Splunk server:

  • splunk version

To verify if the splunk_archiver app is installed and enabled, use the command:

  • splunk list app

Monitoring for unusual renaming or modification of critical Splunk directories could also indicate exploitation attempts, but no specific detection commands are provided.

Mitigation Strategies

Immediate mitigation steps include upgrading Splunk Enterprise or Splunk Cloud Platform to the fixed versions that address this vulnerability.

  • Upgrade to Splunk Enterprise version 10.2.2 or later, or the corresponding patched versions for Splunk Cloud Platform.
  • If upgrading is not immediately possible, disable the splunk_archiver app to prevent exploitation, noting that this will stop automated cold-to-frozen bucket transitions.

If the splunk_archiver app is not in use, the risk and impact are minimal.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20240. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart