Critical Splunk RCE Vulnerability Allows Attackers to Execute Arbitrary Shell Commands

A high‑severity remote command execution (RCE) vulnerability has been discovered in Splunk Enterprise and Splunk Cloud Platform, exposing enterprise environments to potential system compromise.

The vulnerability, tracked as CVE-2026-20163 and assigned a CVSS score of 8.0, allows attackers to execute arbitrary shell commands on the host operating system if specific privilege conditions are met.

Security researchers identified the flaw as an improper input neutralization issue classified under CWE‑77.

This category of vulnerability occurs when software fails to properly sanitize user-supplied input before passing it to system commands, potentially enabling attackers to inject malicious instructions.

If exploited successfully, the flaw could allow threat actors to run unauthorized commands on affected Splunk servers, potentially leading to full system takeover.

Technical Exploitation Details

The vulnerability originates from Splunk’s REST API, specifically the endpoint:

/splunkd/__upload/indexing/preview

This endpoint is used when users upload files to the Splunk platform. Before uploaded files are indexed and stored, Splunk generates a preview to analyze their contents.

During this process, the application relies on a parameter known as unarchive_cmd to process archived files.

Researchers discovered that Splunk does not properly sanitize input passed through this parameter.

An attacker could inject malicious shell commands into the parameter value, which would then be executed by the underlying operating system during the file preview stage.

In practical terms, this means that when the platform processes a specially crafted file upload request, the system may inadvertently execute attacker-controlled commands.

Despite its severity, the vulnerability includes an important restriction. To exploit CVE-2026-20163, an attacker must already possess a user account with the edit_cmd capability.

This privilege is typically assigned to high-level administrative users. While this requirement reduces the likelihood of exploitation by external attackers, it significantly increases the risk in cases where administrator credentials are compromised.

Affected versions include:

• Splunk Enterprise 10.0: Versions 10.0.0 through 10.0.3
• Splunk Enterprise 9.4: Versions 9.4.0 through 9.4.8
• Splunk Enterprise 9.3: Versions 9.3.0 through 9.3.9
• Splunk Cloud Platform: Versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.24

The base Splunk Enterprise 10.2 release is not affected by this vulnerability.

Mitigation and Security Updates

Splunk has released security updates addressing the improper input sanitization issue across all impacted branches.

Administrators are strongly advised to upgrade to the patched versions immediately to reduce the risk of exploitation.

Recommended upgrades include:

• Upgrade Splunk Enterprise 10.0 to version 10.0.4
• Upgrade Splunk Enterprise 9.4 to version 9.4.9
• Upgrade Splunk Enterprise 9.3 to version 9.3.10

For Splunk Cloud Platform customers, the company is actively monitoring environments and deploying patches to hosted instances automatically.

Security teams should also review user privileges within Splunk deployments and restrict the edit_cmd capability to only trusted administrators.

Limiting privileged access and enforcing strong authentication controls can help reduce the likelihood of exploitation if credentials are compromised.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post Critical Splunk RCE Vulnerability Allows Attackers to Execute Arbitrary Shell Commands appeared first on Cyber Security News.