7.2

CVE-2026-20163

Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise

In Splunk Enterprise versions below 10.2.0, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.5, 10.0.2503.12, 10.1.2507.16, and 9.3.2411.124, a user who holds a role that contains the high-privilege capability `edit_cmd` could execute arbitrary shell commands using the `unarchive_cmd` parameter for the `/splunkd/__upload/indexing/preview` REST endpoint.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Splunk ≫ Splunk SwEditionenterprise Version >= 9.3.0 < 9.3.10
Splunk ≫ Splunk SwEditionenterprise Version >= 9.4.0 < 9.4.9
Splunk ≫ Splunk SwEditionenterprise Version >= 10.0.0 < 10.0.4
Splunk ≫ Splunk Cloud Platform Version >= 9.3.2411 < 9.3.2411.124
Splunk ≫ Splunk Cloud Platform Version >= 10.0.2503 < 10.0.2503.12
Splunk ≫ Splunk Cloud Platform Version >= 10.1.2507 < 10.1.2507.16
Splunk ≫ Splunk Cloud Platform Version >= 10.2.2510 < 10.2.2510.5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.07% 0.217
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
psirt@cisco.com 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.