CVE-2026-20163

What it is

In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability `edit_cmd` could execute arbitrary shell commands using the `unarchive_cmd` parameter for the `/splunkd/__upload/indexing/preview` REST endpoint.

At a glance

Exploitability

Can be exploited over the network with an admin-level account. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.5% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-03-11 17:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 10:17 UTC Last updatedMost recent change to the record

Details

Published

2026-03-11 17:16 UTC

Last modified

2026-06-17 10:17 UTC

Exploit probability

0.5% · EPSS, next 30 days

Weakness

CWE-77 · Command injection

Record status

Analyzed

Affected

• Splunk < 9.3.10
• Splunk < 9.4.9
• Splunk < 10.0.4
• Splunk Cloud Platform < 9.3.2411.124
• Splunk Cloud Platform < 10.0.2503.12
• Splunk Cloud Platform < 10.1.2507.16
• Splunk Cloud Platform < 10.2.2510.5

Attack profile CVSS 3.1 · 7.2

Attack vector

Network

Complexity

Low

Privileges needed

High

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High