Vulnerability details
CVE-2026-20163
Splunk Cloud PlatformSplunk Enterprise
Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise
CVSS 3.1
8.0High
Official description
In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability `edit_cmd` could execute arbitrary shell commands using the `unarchive_cmd` parameter for the `/splunkd/__upload/indexing/preview` REST endpoint.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.0High | 3.1 | CVEProject cvelistV5 (CNA) (cisco) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Splunk | Splunk Cloud Platform | 10.0.2503 ≤ v < 10.0.2503.12 | CVEProject cvelistV5 (CNA) |
| Splunk | Splunk Cloud Platform | 10.1.2507 ≤ v < 10.1.2507.16 | CVEProject cvelistV5 (CNA) |
| Splunk | Splunk Cloud Platform | 10.2.2510 ≤ v < 10.2.2510.5 | CVEProject cvelistV5 (CNA) |
| Splunk | Splunk Cloud Platform | 9.3.2411 ≤ v < 9.3.2411.124 | CVEProject cvelistV5 (CNA) |
| Splunk | Splunk Enterprise | 10.0 ≤ v < 10.0.4 | CVEProject cvelistV5 (CNA) |
| Splunk | Splunk Enterprise | 9.3 ≤ v < 9.3.10 | CVEProject cvelistV5 (CNA) |
| Splunk | Splunk Enterprise | 9.4 ≤ v < 9.4.9 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-11
- Last updated
- 2026-03-12
- State
- Published
- Assigner (CNA)
- cisco
Exploit prediction (EPSS)
0.53%
Probability of exploitation in 30 days
45.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-77The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.