PT-2026-24735 · Splunk · Splunk Cloud Platform+2

Danylo Dmytriiev + 3 · Published 2026-03-11 · Updated 2026-04-16 · CVE-2026-20163

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.0, 10.0.4, 9.4.9, and 9.3.10 Splunk Cloud Platform versions prior to 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124

Description A user with a role containing the edit cmd capability can execute arbitrary shell commands. This is possible through the unarchive cmd parameter of the /splunkd/ upload/indexing/preview REST endpoint. The issue stems from inadequate input sanitization, allowing for remote command execution.

Recommendations Update Splunk Enterprise to version 10.2.0 or later. Update Splunk Cloud Platform to version 10.2.2510.5 or later. Remove the edit cmd capability from user roles if an immediate update is not possible.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-20163

Affected Products

Splunk Cloud Platform

Splunk Enterprise

Splunk

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-20163 · Security Note
• https://advisory.splunk.com/advisories/SVD-2026-0302 · Vendor Advisory
• https://twitter.com/CVEnew/status/2032998301893632123 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1rrw3ni/splunk_and_zoom_issue_critical_security_patches · Reddit Post
• https://twitter.com/TrustleSecurity/status/2032414328721129774 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2031927254205264087 · Twitter Post
• https://twitter.com/threatcluster/status/2032049116038009207 · Twitter Post
• https://twitter.com/integ_sec/status/2035009666560729151 · Twitter Post
• https://twitter.com/annexustech/status/2032054496277532862 · Twitter Post
• https://t.me/CVEtracker/47142 · Telegram Post
• https://twitter.com/CymonSkinner/status/2044665407244587022 · Twitter Post