Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2026-20163

Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisco

Description

In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability `edit_cmd` could execute arbitrary shell commands using the `unarchive_cmd` parameter for the `/splunkd/__upload/indexing/preview` REST endpoint.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Splunk Splunk Enterprise

  • 10.0 to < 10.0.4affected
  • 9.4 to < 9.4.9affected
  • 9.3 to < 9.3.10affected

Splunk Splunk Cloud Platform

  • 10.2.2510 to < 10.2.2510.5affected
  • 10.0.2503 to < 10.0.2503.12affected
  • 10.1.2507 to < 10.1.2507.16affected
  • 9.3.2411 to < 9.3.2411.124affected

References