CVE-2026-20297Patch(splunk / splunk)

LOWCVSS 7.2 · HIGH

Signal is active with 4 mentions in latest observed window

Immediate actions

Patch splunk splunk systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow, which does not restrict the installation path to the intended app directory.

splunk CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://advisory.splunk.com/advisories/SVD-2026-0703

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

splunk
splunk_cloud_platform

Threat summary

Patch or workaround signal is available
4 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 4 signals
Technical details provided in 3 signals
4 total mentions across 1 day

Affected systems

Vendors

splunk

Products

splunksplunk_cloud_platform

1 version affected across 2 products

Deep dive

Activity timeline4 mentions / 1d

Signal classification1 categories

Patch

4100.0%

Referenced assets3 URLs

By indicator

Full discourse4 posts

Daily CyberSecurity@Daily_CyberSec91d
Patch
Splunk patched three Splunk Enterprise vulnerabilities: CVE-2026-20296 CSRF, CVE-2026-20297 path traversal, and CVE-2026-20298 credential exposure. #Splunk #CVE202620296 #CSRF #Vulnerability #InfoSec http://securityonline.info/splunk-enterprise-vulnerabilities-cve-2026-20296/
Post summary
Splunk has released patches for CVE-2026-20296 (CSRF), CVE-2026-20297 (path traversal), and CVE-2026-20298 (credential exposure), with the post providing CVE identifiers and the nature of each vulnerability but no indication of exploitation or PoC.
02021409
12.9K followersView on X
CCB Alert@CCBalert91d
Patch
Warning: #Splunk has released patches for critical vulnerabilities in Splunk Enterprise, including a #CSRF flaw (CVE-2026-20296, CVSS 8.3) allowing privileged SPL execution, and a path traversal bug (CVE-2026-20297, CVSS 7.2). https://advisory.splunk.com/ #Patch #Patch #Patch
Post summary
Splunk released patches for two critical vulnerabilities—CVE‑2026‑20296 (CSRF) and CVE‑2026‑20297 (path traversal)—with CVSS scores of 8.3 and 7.2, respectively.
02010284
7.2K followersView on X
The Daily Tech Feed@dailytechonx91d
Patch
Splunk has patched critical vulnerabilities in its Enterprise and Cloud Platform, including CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298. Users should update to versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, or later to mitigate these security risks. #Splunk #CyberSecurity #Vulnerability #SecurityUpdate #CVE202620296 #CVE202620297 #CVE202620298 https://thedailytechfeed.com/splunk-patches-critical-vulnerabilities-in-enterprise-platform/
Post summary
Splunk released patch updates for CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298, advising users to update to specified versions to mitigate the vulnerabilities.
0000060
539 followersView on X
TECHEPAGES@techepages91d
Patch
⚠️ Splunk just patched three vulnerabilities in Splunk Enterprise & Cloud Platform — the worst (CVE-2026-20296, CVSS 8.3) lets attackers run arbitrary SPL searches as splunk-system-user via a phishing link, potentially exposing indexed data and stored credentials. What to know: 🔹 Upgrade to 10.4.1 / 10.2.5 / 10.0.8 / 9.4.13+ 🔹 Path traversal flaw (CVE-2026-20297) can write files outside app directories 🔹 Low-priv users could pull credential hashes via the REST endpoint 🔹 Quick wins: set mask_encr_password = true & disable Splunk Web where unused
Post summary
Splunk has released patches for three CVEs, urging immediate upgrades to the latest versions and offering configuration mitigations to prevent arbitrary search execution, path traversal, and credential extraction.
0000038
23 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	splunk	splunk	-	-	-
App	splunk	splunk	10.4.0	-	-
App	splunk	splunk_cloud_platform	-	-	-

Explore more

Back to dashboard splunk CVEs splunk vulnerabilities

What researchers are saying

CVE-2026-20297

The Daily Tech Feed[verified]@dailytechonxPatch

Splunk released patch updates for CVE-2026-20296, CVE-2026-20297, and CVE-2026-20298, advising users to update to specified versions to mitigate the vulnerabilities.

TECHEPAGES[verified]@techepagesPatch

Splunk has released patches for three CVEs, urging immediate upgrades to the latest versions and offering configuration mitigations to prevent arbitrary search execution, path traversal, and credential extraction.

Daily CyberSecurity@Daily_CyberSecPatch

Splunk has released patches for CVE-2026-20296 (CSRF), CVE-2026-20297 (path traversal), and CVE-2026-20298 (credential exposure), with the post providing CVE identifiers and the nature of each vulnerability but no indication of exploitation or PoC.

CCB Alert@CCBalertPatch

Splunk released patches for two critical vulnerabilities—CVE‑2026‑20296 (CSRF) and CVE‑2026‑20297 (path traversal)—with CVSS scores of 8.3 and 7.2, respectively.