In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability `edit_cmd` could execute arbitrary shell commands using the `unarchive_cmd` parameter for the `/splunkd/__upload/indexing/preview` REST endpoint.
References
| Link | Resource |
|---|---|
| https://advisory.splunk.com/advisories/SVD-2026-0302 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
24 Mar 2026, 16:54
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:* cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:* |
|
| Summary |
|
|
| References | () https://advisory.splunk.com/advisories/SVD-2026-0302 - Vendor Advisory | |
| First Time |
Splunk splunk
Splunk Splunk splunk Cloud Platform |
11 Mar 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-11 17:16
Updated : 2026-03-24 17:10
NVD link : CVE-2026-20163
Mitre link : CVE-2026-20163
CVE.ORG link : CVE-2026-20163
JSON object : View
Products Affected
splunk
- splunk_cloud_platform
- splunk
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')