CVE-2026-20163

CWE-77 — Command Injection4 documents4 sources
Severity
7.2HIGH
EPSS
0.1%
top 75.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Splunk Splunk Cloud PlatformSplunk Splunk EnterpriseSplunk Splunk
Timeline
PublishedMar 11

Description

In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability `edit_cmd` could execute arbitrary shell commands using the `unarchive_cmd` parameter for the `/splunkd/__upload/indexing/preview` REST endpoint.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5splunk/splunk_cloud_platform10.2.2510 — 10.2.2510.5+3
▶NVDsplunk/splunk_cloud_platform9.3.2411 — 9.3.2411.124+3
▶CVEListV5splunk/splunk_enterprise10.0 — 10.0.4+2
▶NVDsplunk/splunk9.3.0 — 9.3.10+2

🔴Vulnerability Details

2
GHSA
GHSA-7vjc-jh6c-q29g: In Splunk Enterprise versions below 10↗2026-03-11
▶
CVEList
Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise↗2026-03-11
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-20163 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶