VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 11, 2026· Updated Mar 12, 2026

Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise

CVE-2026-20163

Description

In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability edit_cmd could execute arbitrary shell commands using the unarchive_cmd parameter for the /splunkd/__upload/indexing/preview REST endpoint.

Affected products

4
  • Splunk/Splunk Cloud Platformllm-fuzzy
    Range: < 9.3.2411.124, < 10.0.2503.12, < 10.1.2507.16, < 10.2.2510.5
  • Splunk/Splunk Enterprisellm-fuzzy
    Range: < 9.3.10, < 9.4.9, < 10.0.4, < 10.2.0
  • Splunk/Splunk Cloud Platformv5
    Range: 10.2.2510
  • Splunk/Splunk Enterprisev5
    Range: 10.0

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.