Splunk Enterprise for Windows Vulnerability Let Attackers Hijack DLLs and Gain SYSTEM Access
Splunk has disclosed a high-severity vulnerability identified as CVE-2026-20140 in Splunk Enterprise for Windows . This vulnerability allows a low-privileged local user to escalate their privileges to SYSTEM level via a DLL search-order hijacking attack.
Splunk has disclosed a high-severity vulnerability identified as CVE-2026-20140 in Splunk Enterprise for Windows . This vulnerability allows a low-privileged local user to escalate their privileges to SYSTEM level via a DLL search-order hijacking attack.
Published on February 18, 2026, under advisory SVD-2026-0205, this flaw has a CVSSv3.1 score of 7.7 (High) and falls under CWE-427 (Uncontrolled Search Path Element).
The affected versions of Splunk Enterprise for Windows are below 10.2.0, 10.0.3, 9.4.8, 9.3.9, and 9.2.12. An attacker exploiting this flaw can create a directory on the system drive where Splunk is installed and place a malicious DLL inside it. Upon restarting the Splunk Enterprise service, the rogue DLL may be loaded due to insecure library search order, granting SYSTEM-level privileges to the attacker.
The CVSS vector indicates that the vulnerability requires local access (AV:L), limiting remote exploitation. However, the high complexity (AC:H) and requirement for user interaction (UI:R) present significant risks in shared or multi-user Windows environments.
The vulnerability's scope change (S:C) and high impact ratings on Confidentiality, Integrity, and Availability highlight its potential severity. It is important to note that non-Windows Splunk deployments are not affected, and the severity is rated as Informational.
Product Affected Versions Fixed Version
Splunk has disclosed a high-severity vulnerability identified as CVE-2026-20140 in Splunk Enterprise for Windows .
Splunk Enterprise 10.0 10.0.0 to 10.0.2 10.0.3
Splunk Enterprise 9.4 9.4.0 to 9.4.7 9.4.8
Splunk Enterprise 9.3 9.3.0 to 9.3.8 9.3.9
Splunk Enterprise 9.2 9.2.0 to 9.2.11 9.2.12
Splunk Enterprise 10.2 Not Affected 10.2.0
Splunk has addressed the flaw in versions 10.2.0, 10.0.3, 9.4.8, 9.3.9, and 9.2.12. Organizations using Splunk Enterprise on Windows are advised to apply the relevant patch promptly.
If immediate patching is not feasible, it is recommended that administrators restrict write permissions on directories within the system drive to prevent unauthorized DLL placement.
There have been no reports of active detections or exploits in the wild. The vulnerability was responsibly disclosed by security researcher Marius Gabriel Mihai.
Based on reporting by Cyber Security News.