Vulnerabilities Splunk Enterprise Update Patches Code Execution Vulnerability The flaw allows low-privileged users to upload files to a temporary directory to achieve remote code execution. By Ionut Arghire | April 16, 2026 (7:51 AM ET) Flipboard Reddit Whatsapp Whatsapp Email Splunk has announced fixes for vulnerabilities in Splunk Enterprise, Cloud Platform, and MCP Server, as well as in third-party packages across its products. A high-severity flaw in Splunk Enterprise and Cloud Platform, tracked as CVE-2026-20204, could be exploited by low-privileged users to upload a malicious file to a temporary directory and achieve remote code execution (RCE). The bug exists because temporary files are improperly handled and are not sufficiently isolated in that directory, Splunk says. Two medium-severity issues were addressed in Splunk Enterprise and Cloud Platform. One could be exploited to create usernames containing a null byte or a non-UTF-8 percent-encoded byte, preventing their conversion to a proper format, while the other allows attackers to turn Data Model Acceleration on or off. Users should update to Splunk Enterprise versions 10.2.2, 10.0.5, 9.4.10, 9.3.11, or higher, which contain fixes for all these security defects. Splunk is patching Cloud Platform instances. On Wednesday, the company also resolved CVE-2026-20205, a high-severity vulnerability in the MCP Server app that could allow authenticated attackers to view users’ sessions and authorization tokens in clear text. Advertisement. Scroll to continue reading. “The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives,” Splunk notes. Fixes for the bug were included in the MCP Server app version 1.0.3. Additionally, the company rolled out fixes for bugs in third-party packages in Splunk Enterprise, Operator for Kubernetes Add-on, IT Service Intelligence (ITSI) app, and Universal Forwarder. Splunk makes no mention of any of these vulnerabilities being exploited in the wild. Additional information can be found on the company’s security advisories page. Related: Cisco Patches Critical Vulnerabilities in Webex, ISE Related: Exploited Vulnerability Exposes Nginx Servers to Hacking Related: ‘By Design’ Flaw in MCP Could Enable Widespread AI Supply Chain Attacks Related: Splunk, Zoom Patch Severe Vulnerabilities Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire 100 Chrome Extensions Steal User Data, Create Backdoor Mirax RAT Targeting Android Users in Europe Two Vulnerabilities Patched in Ivanti Neurons for ITSM Fortinet Patches Critical FortiSandbox Vulnerabilities SAP Patches Critical ABAP Vulnerability Triad Nexus Evades Sanctions to Fuel Cybercrime Google Adds Rust DNS Parser to Pixel Phones for Better Security Organizations Warned of Exploited Windows, Adobe Acrobat Vulnerabilities Latest News Microsoft Paid Out $2.3 Million at Zero Day Quest 2026 Hacking Contest NIST Prioritizes NVD Enrichment for CVEs in CISA KEV, Critical Software Cisco Patches Critical Vulnerabilities in Webex, ISE Ransomware Hits Automotive Data Expert Autovista Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments Sweden Blames Pro-Russian Group for Cyberattack Last Year on Its Energy Infrastructure Exploited Vulnerability Exposes Nginx Servers to Hacking Capsule Security Emerges From Stealth With $7 Million in Funding Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: A Step-by-Step Approach to AI Governance April 28, 2026 With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment. Register Virtual Event: Threat Detection and Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register People on the Move Thomas Bain has been appointed Chief Marketing Officer at Silent Push. The United States Department of War appointed David Vaughn as Technical Advisor for Data Infrastructure. Black Duck has named Dom Glavach as Chief Information Security Officer. More People On The Move Expert Insights The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. (Joshua Goldfarb) The New Rules of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural. (Nadir Izrael) The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue. (Steve Durbin) Why Agentic AI Systems Need Better Governance – Lessons from OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) The Human IOC: Why Security Professionals Struggle with Social Vetting Applying SOC-level rigor to the rumors, politics, and 'human intel' can make or break a security team. (Joshua Goldfarb) Flipboard Reddit Whatsapp Whatsapp Email