Critical Splunk CVE-2026-20163 RCE Vulnerability

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

Critical

CVE-2026-20163

Splunk

March 12, 2026

Executive Summary

CVE-2026-20163 is a high‑severity RCE in Splunk REST API file upload preview. If abused, it can allow arbitrary shell command execution on Splunk hosts.

Key Details

Affected Platform

Splunk

Attack Surface

Recommended Action

Apply vendor patch

Affected Environment

Splunk Enterprise versions 9.3, 9.4 and 10.0 using the REST API are exposed. Splunk Cloud Platform below 10.2.2510.5 is also affected by this RCE flaw.

Operational Impact

Successful exploitation can provide full control over affected Splunk servers. Attackers could then alter logs, pivot to other systems, or disrupt monitoring.

Technical Root Cause

The unarchive_cmd parameter in the preview process does not strictly sanitize input. This weak validation allows injection of shell commands into upload handling.

Recommended Mitigation

Upgrade Splunk Enterprise 10.0 to 10.0.4, 9.4 to 9.4.9, and 9.3 to 9.3.10.
Ensure Splunk Cloud Platform instances are on at least 10.2.2510.5.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore MDR for Splunk

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Vendor advisory: Splunk SVD-2026-0302 provides official details and fixes. See https://advisory.splunk.com/advisories/SVD-2026-0302 for full guidance.