# CVE-2026-20240: Splunk Enterprise Denial of Service in coldToFrozen script

Source: https://junglewise.ai/threats/cve-2026-20240-splunk-enterprise-denial-of-service-in-coldtofrozen-script  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-20240 · Severity: medium · CVSS 6.5 · Published 2026-05-20

Splunk Enterprise and Splunk Cloud Platform are data analysis platforms used for monitoring and searching machine-generated data. A vulnerability in the archiving component allows a user with low-level access to rename critical system directories. This can lead to a complete service outage, making the Splunk instance non-functional and disrupting data operations.

Technologies: [Splunk Cloud Platform](https://junglewise.ai/threats/technologies/cloud-platform). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-20240 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20240 being exploited in the wild.

**How severe is CVE-2026-20240?** Medium severity, with a CVSS score of 6.5, published 20 May 2026.

**Which products and versions are affected?** Splunk Cloud Platform Below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, 9.3.2411.129.

**Is there a fix for CVE-2026-20240?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20240 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20240?** Check whether you run Splunk Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input validation vulnerability (CWE-20) exists in the 'coldToFrozen.sh' script within the 'splunk_archiver' application. The script accepts arbitrary file paths and performs rename operations without restricting them to safe or intended directories. A remote attacker with low-privileged authenticated access (non-admin/non-power user) can provide malicious paths to rename critical Splunk system directories. This action results in a Denial of Service (DoS) by making the Splunk instance non-functional. The issue is resolved in Splunk Enterprise versions 10.2.2, 10.0.5, 9.4.11, 9.3.12, and various Splunk Cloud Platform maintenance releases.

## Affected products

- Splunk Splunk Enterprise Below 10.2.2, 10.0.5, 9.4.11, 9.3.12
- Splunk Splunk Cloud Platform Below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, 9.3.2411.129

## Timeline

- 2026-05-20: disclosed
- 2026-05-20: advisory

## References

- [https://advisory.splunk.com/advisories/SVD-2026-0504](https://advisory.splunk.com/advisories/SVD-2026-0504)

## Related threats

- [Splunk Enterprise and Cloud Platform information disclosure in REST API](https://junglewise.ai/threats/cve-2026-20298-splunk-enterprise-and-cloud-platform-information-disclosure-in)
- [Splunk Enterprise path traversal in App Install REST endpoint](https://junglewise.ai/threats/cve-2026-20297-splunk-enterprise-path-traversal-in-app-install-rest-endpoint)
- [Splunk Enterprise improper access control in saved search ownership](https://junglewise.ai/threats/cve-2026-20259-splunk-enterprise-improper-access-control-in-saved-search)
- [Splunk Enterprise stored XSS in classic dashboard HTML panel](https://junglewise.ai/threats/cve-2026-20258-splunk-enterprise-stored-xss-in-classic-dashboard-html-panel)
- [Splunk Enterprise and Cloud Platform Data Exfiltration in Classic Dashboards](https://junglewise.ai/threats/cve-2026-20257-splunk-enterprise-and-cloud-platform-data-exfiltration-in-classic)