Vulnerability · Published Mar 11, 2026 · Assigned by cisco

CVE-2026-20163Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise

High 8.0

In plain English

A high-severity command injection in Splunk Cloud Platform from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.5%top 54.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability `edit_cmd` could execute arbitrary shell commands using the `unarchive_cmd` parameter for the `/splunkd/__upload/indexing/preview` REST endpoint.

Affected products (as reported)

Vendor	Product	Versions
Splunk	Splunk Enterprise	10.0 – before 10.0.49.4 – before 9.4.99.3 – before 9.3.10
Splunk	Splunk Cloud Platform	10.2.2510 – before 10.2.2510.510.0.2503 – before 10.0.2503.1210.1.2507 – before 10.1.2507.169.3.2411 – before 9.3.2411.124

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://advisory.splunk.com/advisories/SVD-2026-0302