CVE-2026-20240
Denial of Service in Splunk Enterprise via coldToFrozen.sh
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| splunk | splunk_enterprise | to 9.3.12 (exc) |
| splunk | splunk_cloud_platform | to 9.3.2411.129 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-20240 is a high-severity vulnerability in Splunk Enterprise and Splunk Cloud Platform that allows a low-privileged user without admin or power roles to cause a Denial of Service (DoS).
The vulnerability exists because the coldToFrozen.sh script in the splunk_archiver app lacks proper input validation, allowing arbitrary file path renaming. This can disrupt critical Splunk directories and make the instance non-functional.
Affected versions include Splunk Enterprise below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, as well as Splunk Cloud Platform below specific patch levels.
How can this vulnerability impact me? :
This vulnerability can cause a Denial of Service (DoS) on your Splunk instance by allowing a low-privileged user to rename critical directories, rendering the system non-functional.
If exploited, it disrupts the normal operation of Splunk, potentially causing downtime and loss of access to important data and services.
Mitigation involves upgrading to patched versions or disabling the splunk_archiver app, though disabling the app stops automated cold-to-frozen bucket transitions.
If the splunk_archiver app is unused, the impact is minimal.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying if the affected versions of Splunk Enterprise or Splunk Cloud Platform are in use and whether the splunk_archiver app is installed and active.
You can check the Splunk version by running the following command on the Splunk server:
- splunk version
To verify if the splunk_archiver app is installed and enabled, use the command:
- splunk list app
Monitoring for unusual renaming or modification of critical Splunk directories could also indicate exploitation attempts, but no specific detection commands are provided.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Splunk Enterprise or Splunk Cloud Platform to the fixed versions that address this vulnerability.
- Upgrade to Splunk Enterprise version 10.2.2 or later, or the corresponding patched versions for Splunk Cloud Platform.
- If upgrading is not immediately possible, disable the splunk_archiver app to prevent exploitation, noting that this will stop automated cold-to-frozen bucket transitions.
If the splunk_archiver app is not in use, the risk and impact are minimal.