CVE-2026-20163 — Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise

Description (CNA)

In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability `edit_cmd` could execute arbitrary shell commands using the `unarchive_cmd` parameter for the `/splunkd/__upload/indexing/preview` REST endpoint.

Affected (CNA)

Vendor / product	Versions
Splunk / Splunk Enterprise	affected 10.0 before 10.0.4; affected 9.4 before 9.4.9; affected 9.3 before 9.3.10
Splunk / Splunk Cloud Platform	affected 10.2.2510 before 10.2.2510.5; affected 10.0.2503 before 10.0.2503.12; affected 10.1.2507 before 10.1.2507.16; affected 9.3.2411 before 9.3.2411.124

CWE

CWE-77

References

https://advisory.splunk.com/advisories/SVD-2026-0302

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.