high7.2
CVE-2026-20163
In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.…
Impact
In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability `edit_cmd` could execute arbitrary shell commands using the `unarchive_cmd` parameter for the `/splunkd/__upload/indexing/preview` REST endpoint.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Splunk | Splunk | from 9.3.0 before 9.3.10 from 9.4.0 before 9.4.9 from 10.0.0 before 10.0.4 |
| Splunk | Splunk Cloud Platform | from 9.3.2411 before 9.3.2411.124 from 10.0.2503 before 10.0.2503.12 from 10.1.2507 before 10.1.2507.16 from 10.2.2510 before 10.2.2510.5 |