Detections
Analytics
CVE-2026-20140
high
Description
In Splunk Enterprise for Windows versions below 10.2.0, 10.0.3, 9.4.8, 9.3.9, and 9.2.12, a low‑privileged Windows user who can create a directory on the system drive where Splunk Enterprise is installed and write a malicious DLL into that directory, might cause Splunk Enterprise for Windows to load that DLL during Splunk Enterprise service startup. This condition can result in a Local Privilege Escalation (LPE) through a DLL search‑order hijacking, as the injected DLL might run with system level privileges when the Splunk Enterprise instance restarts.