CVE-2026-20139

4.3 MEDIUM 6% exploit odds Fix listed Denial of service Server

What it is

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload into the `realname`, `tz`, or `email` parameters of the `/splunkd/__raw/services/authentication/users/username` REST API endpoint when they change a password. This could potentially lead to a client‑side denial‑of‑service (DoS). The malicious payload might significantly slow page load times or render Splunk Web temporarily unresponsive.

At a glance

Exploitability: Can be exploited over the network with a low-privilege account. Limited direct impact.
Exploit odds: 5.7% chance of exploitation in the next 30 days (EPSS).
Fix: A patch, advisory or fixed version is referenced. Upgrade or apply it.