CVE-2026-20139: splunk Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-20139 is a medium (CVSS 4.3) Uncontrolled Resource Consumption vulnerability in splunk. EPSS estimates a 5.68% chance of exploitation in the next 30 days, higher than 92.9% of scored vulnerabilities.
Timeline
- 18-02-2026PublishedVulnerability first disclosed.
- 19-02-2026Last modifiedVulnerability information updated.
Description
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12, and Splunk Cloud Platform versions below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload into the `realname`, `tz`, or `email` parameters of the `/splunkd/__raw/services/authentication/users/username` REST API endpoint when they change a password. This could potentially lead to a client‑side denial‑of‑service (DoS). The malicious payload might significantly slow page load times or render Splunk Web temporarily unresponsive.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
5.68%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
+0.63 pp
From 5.05% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Splunk3 products
- splunk≥ 9.2.0, < 9.2.12 | ≥ 9.3.0, < 9.3.9 | ≥ 9.4.0, < 9.4.8 | ≥ 10.0.0, < 10.0.2
- splunk_cloud_platform≥ 9.3.2411, < 9.3.2411.121 | ≥ 10.0.2503, < 10.0.2503.9 | ≥ 10.1.2507, < 10.1.2507.8 | ≥ 10.2.2510, < 10.2.2510.3
- splunk enterprise≥ 10.0, < 10.0.2 | ≥ 9.4, < 9.4.8 | ≥ 9.3, < 9.3.9 | ≥ 9.2, < 9.2.12
1 vendor · 3 products
References
1 links- advisory.splunk.com/advisories/SVD-2026-0204Vendor Advisory