CVE-2026-20139: 
Splunk Enterprise vulnerability analysis and mitigation

CVE-2026-20139 is a client-side Denial-of-Service (DoS) vulnerability in Splunk Enterprise and Splunk Cloud Platform that allows a low-privileged user to inject malicious payloads via user profile parameters during a password change operation. Affected Splunk Enterprise versions include those below 10.2.0, 10.0.2, 9.4.8, 9.3.9, and 9.2.12; affected Splunk Cloud Platform versions include those below 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, and 9.3.2411.121. The vulnerability was disclosed on February 18, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 4.3 (Medium) (Splunk Advisory).

The root cause is Uncontrolled Resource Consumption (CWE-400), where the /splunkd/__raw/services/authentication/users/username REST API endpoint fails to properly validate or sanitize input in the realname, tz, or email parameters when a user changes their password. A low-privileged user (without the "admin" or "power" Splunk roles) can craft a malicious payload into these fields, which when rendered by Splunk Web causes excessive resource consumption on the client side. The attack vector is network-based, requires low privileges, and no user interaction beyond the attacker's own actions. Associated attack patterns include Regular Expression Exponential Blowup (CAPEC-492) and XML Ping of the Death (CAPEC-147) (Splunk Advisory).

Successful exploitation results in a client-side DoS condition, where the malicious payload significantly slows page load times or renders Splunk Web temporarily unresponsive for users viewing the affected profile data. The impact is limited to availability (low) with no confidentiality or integrity compromise. While the scope is unchanged and the effect is temporary, degraded Splunk Web availability could impair security monitoring and operational visibility for organizations relying on Splunk as a SIEM or observability platform (Splunk Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is approximately 0.045%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Tenable Nessus plugin 299411 (Splunk Advisory, Tenable).

1. Authenticate: Log in to the Splunk instance as any low-privileged user (not requiring "admin" or "power" roles).
2. Identify the target endpoint: Locate the REST API endpoint /splunkd/__raw/services/authentication/users/<username> used for password and profile changes.
3. Craft malicious payload: Prepare a payload designed to cause excessive client-side resource consumption (e.g., a deeply nested or exponentially expanding string) and insert it into the realname, tz, or email parameter.
4. Submit the request: Trigger a password change request via the REST API with the crafted payload embedded in one or more of the vulnerable parameters.
5. Impact: When other users or administrators load pages that render the affected user's profile data in Splunk Web, the malicious payload causes significant slowdowns or temporary unresponsiveness of the Splunk Web interface (Splunk Advisory).

• Network: Unusual or repeated POST/PUT requests to /splunkd/__raw/services/authentication/users/<username> from low-privileged accounts, especially with abnormally large or malformed values in realname, tz, or email fields.
• Logs: Splunk internal logs (splunkd.log) showing REST API calls to the authentication users endpoint with oversized parameter values; browser-side performance degradation reported by users accessing Splunk Web.
• Behavioral: Splunk Web becoming intermittently slow or unresponsive following profile update activity by non-admin users; repeated password change events from the same low-privileged account in audit logs.

Splunk has released patched versions addressing this vulnerability. For Splunk Enterprise, upgrade to version 10.2.0, 10.0.2, 9.4.8, 9.3.9, or 9.2.12 or later. For Splunk Cloud Platform, upgrade to version 10.2.2510.3, 10.1.2507.8, 10.0.2503.9, or 9.3.2411.121 or later. As interim mitigations, consider restricting REST API access to trusted networks and monitoring for suspicious password change activity involving unusual user profile parameters (Splunk Advisory).

The vulnerability received routine coverage from vulnerability tracking platforms including VulnDB, CVEFeed, and CIRCL shortly after disclosure. Security monitoring organizations such as EG-FinCIRT published Splunk security update notices referencing this CVE. No notable researcher commentary or significant social media discussion has been identified, consistent with the vulnerability's medium severity and limited exploitation potential (Splunk Advisory).