Splunk Enterprise Update Patches Code Execution Vulnerability

Splunk Enterprise contained a high-severity remote code execution vulnerability (CVE-2026-20204) that allowed low-privileged users to upload malicious files to temporary directories, potentially leading to full system compromise. An additional vulnerability (CVE-2026-20205) in the MCP Server app could expose sensitive user sessions and authorization tokens. This incident highlights the critical importance of maintaining current patch levels for enterprise security platforms, as these systems often have elevated privileges and access to sensitive organizational data. While no active exploitation has been reported, the combination of remote code execution capabilities and session token exposure creates significant risk for organizations running unpatched versions.