VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 11, 2026· Updated Mar 12, 2026

Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise

CVE-2026-20163

Description

In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability edit_cmd could execute arbitrary shell commands using the unarchive_cmd parameter for the /splunkd/__upload/indexing/preview REST endpoint.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Splunk/Splunk Cloud Platformllm-fuzzy2 versions
    < 9.3.2411.124, < 10.0.2503.12, < 10.1.2507.16, < 10.2.2510.5+ 1 more
    • (no CPE)range: < 9.3.2411.124, < 10.0.2503.12, < 10.1.2507.16, < 10.2.2510.5
    • (no CPE)range: 10.2.2510
  • Splunk/Splunk Enterprisellm-fuzzy2 versions
    < 9.3.10, < 9.4.9, < 10.0.4, < 10.2.0+ 1 more
    • (no CPE)range: < 9.3.10, < 9.4.9, < 10.0.4, < 10.2.0
    • (no CPE)range: 10.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.