CVE-2026-20163

Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise

State: Published
Severity: 8.0 High
Published: Mar 11, 2026
Updated: Mar 12, 2026
Reserved: Oct 8, 2025

Description

In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability `edit_cmd` could execute arbitrary shell commands using the `unarchive_cmd` parameter for the `/splunkd/__upload/indexing/preview` REST endpoint.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-77 The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	10.0 to before 10.0.4Affected 9.4 to before 9.4.9Affected 9.3 to before 9.3.10Affected
Splunk Cloud PlatformSplunk	10.2.2510 to before 10.2.2510.5Affected 10.0.2503 to before 10.0.2503.12Affected 10.1.2507 to before 10.1.2507.16Affected 9.3.2411 to before 9.3.2411.124Affected

References

https://advisory.splunk.com/advisories/SVD-2026-0302

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.