This vulnerability in Splunk Enterprise arises from improper handling and insufficient isolation of temporary files in the $SPLUNK_HOME/var/run/splunk/apptemp directory. A low-privileged user lacking admin or power roles can upload a malicious file to this directory, potentially leading to remote code execution. Affected versions include those below 10.2.1, 10.0.5, 9.4.10, and 9.3.11. The CVSS 3.1 score of 7.1 reflects a network attack vector with high impact on confidentiality, integrity, and availability, though requiring high attack complexity and user interaction.

Successful exploitation could allow an attacker with limited Splunk privileges to execute arbitrary code remotely, potentially compromising system and application data confidentiality, integrity, and availability. This elevates the risk profile of affected Splunk Enterprise deployments by enabling privilege escalation and remote control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the apptemp directory and limit user roles to trusted personnel only. Monitor for unusual file uploads in the apptemp directory and consider applying compensating controls to isolate temporary file handling.