[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMZcgAtTdeZVxPPgkUTa55wHrK7IFTBkYLDkPEOs9vkQ":3},{"article":4,"iocs":40,"watch_terms":48,"solutions":49,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"dcb7aa06-45b4-4f3f-ac3c-00b8a15d3bc0","Splunk Enterprise Update Patches Code Execution Vulnerability","splunk-enterprise-update-patches-code-execution-vulnerability-690705","The flaw allows low-privileged users to upload files to a temporary directory to achieve remote code execution. The post Splunk Enterprise Update Patches Code Execution Vulnerability appeared first on SecurityWeek.","Splunk released security updates addressing multiple vulnerabilities across its products, including a high-severity remote code execution flaw (CVE-2026-20204) in Splunk Enterprise and Cloud Platform that allows low-privileged users to upload malicious files to a temporary directory. Additional high-severity vulnerability CVE-2026-20205 in MCP Server app could expose user sessions and authorization tokens. Users are advised to update to patched versions (10.2.2, 10.0.5, 9.4.10, 9.3.11 or higher), with no evidence of active exploitation reported.","Splunk patches high-severity RCE vulnerability in Enterprise and Cloud Platform.","https:\u002F\u002Fwww.securityweek.com\u002Fsplunk-enterprise-update-patches-code-execution-vulnerability\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F03\u002FSplunk.jpeg","2026-04-16T11:51:39+00:00","2026-04-16T12:00:22.443456+00:00",8,[17,20,23,25],{"name":18,"type":19},"Splunk","vendor",{"name":21,"type":22},"Splunk Enterprise","product",{"name":24,"type":22},"Splunk Cloud Platform",{"name":26,"type":22},"MCP Server","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},[41,45],{"type":42,"value":43,"context":44},"cve","CVE-2026-20204","High-severity RCE in Splunk Enterprise and Cloud Platform via improper temporary file handling",{"type":42,"value":46,"context":47},"CVE-2026-20205","High-severity vulnerability in MCP Server app allowing exposure of user sessions and authorization tokens",[18,21,24],{"controls":50,"vendors":134},[51,80,105],{"slug":52,"name":53,"problem":54,"products":55},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":81,"name":82,"problem":83,"products":84},"patch-management","Automated patch management","Known holes get closed in days, not months.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":81,"product_name":102,"url":103,"description":104},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[135],{"slug":136,"name":18,"logo_path":137,"roles":138},"splunk","\u002Fvendor-logos\u002Fsplunk.png",[139],"affected",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":150},"critical-splunk-enterprise-rce-vulnerability-requires-immediate-patching","Critical Splunk Enterprise RCE Vulnerability Requires Immediate Patching","Splunk Enterprise contained a high-severity remote code execution vulnerability (CVE-2026-20204) that allowed low-privileged users to upload malicious files to temporary directories, potentially leading to full system compromise. An additional vulnerability (CVE-2026-20205) in the MCP Server app could expose sensitive user sessions and authorization tokens. This incident highlights the critical importance of maintaining current patch levels for enterprise security platforms, as these systems often have elevated privileges and access to sensitive organizational data. While no active exploitation has been reported, the combination of remote code execution capabilities and session token exposure creates significant risk for organizations running unpatched versions.",[145,146,147,148,149],"CIS Control 7.1","CIS Control 7.3","NIST SI-2","NIST CM-8","NIST AC-6",{}]