CVE-2026-20260 affects Splunk SOAR versions prior to 8.5.0, where the application fails to sanitize HTTP request paths before writing them to log files. This allows an unauthenticated attacker to inject ANSI escape codes into logs. When an administrator views these logs using a terminal emulator, the escape codes may be interpreted, potentially leading to misleading or manipulated log output. The vulnerability is due to improper output neutralization in logging functionality.

The vulnerability allows injection of ANSI escape codes into application logs, which may be interpreted by terminal emulators when logs are viewed. This can lead to log manipulation or obfuscation, potentially misleading administrators during incident response or forensic analysis. There is no direct confidentiality, availability, or authentication impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when viewing logs from untrusted sources and consider filtering or sanitizing log data externally to prevent interpretation of control characters.