Critical severity9.1NVD Advisory· Published Jun 17, 2026· Updated Jun 22, 2026
CVE-2026-20266
CVE-2026-20266
Description
In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance.
The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:splunk:ai_toolkit:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:splunk:ai_toolkit:*:*:*:*:*:*:*:*range: >=5.7.0,<5.7.4
- (no CPE)range: <5.7.4
Patches
Vulnerability mechanics
References
1- advisory.splunk.com/advisories/SVD-2026-0614nvdVendor Advisory
News mentions
3- ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and MoreThe Hacker News · Jun 22, 2026
- Atlassian, Splunk Patch Critical VulnerabilitiesSecurityWeek · Jun 18, 2026
- Splunk AI Toolkit Vulnerability Enables Arbitrary OS Command Execution AttacksCyber Security News · Jun 18, 2026