Loading story…
Splunk disclosed a high-severity remote command execution (RCE) vulnerability, CVE-2026-20163 (CVSS 8.0), affecting Splunk Enterprise and Splunk Cloud Platform. The issue is a command injection weakness (CWE-77) in the REST endpoint /splunkd/__upload/indexing/preview, where user-controlled input is insufficiently sanitized during the “uploaded file preview before indexing” workflow.
Exploitation requires an authenticated user whose role includes the high-privilege capability edit_cmd; under that condition, an attacker can abuse the unarchive_cmd parameter to execute arbitrary shell commands on the underlying host. Reported affected versions include Splunk Enterprise 10.0.0–10.0.3, 9.4.0–9.4.8, and 9.3.0–9.3.9, plus Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, 10.0.2503.12, and 9.3.2411.124; fixed thresholds are Enterprise 10.0.4, 9.4.9, 9.3.10, and 10.2.0 (with the base Enterprise 10.2 release noted as not affected). The disclosure credits researcher Danylo Dmytriiev (DDV_UA) along with Splunk personnel Gabriel Nitu and James Ervin.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk made fixed versions available for affected Splunk Enterprise and Splunk Cloud Platform releases and stated it was deploying patches to impacted cloud instances. The company also recommended upgrading immediately or removing the edit_cmd capability from roles as a workaround.
Splunk disclosed a high-severity vulnerability, CVE-2026-20163, affecting Splunk Enterprise and Splunk Cloud Platform. The flaw allows authenticated users with the edit_cmd capability to execute arbitrary shell commands via the /splunkd/__upload/indexing/preview REST endpoint using the unarchive_cmd parameter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk released security updates for **Splunk Enterprise**, **Splunk Cloud Platform**, and **Splunk Secure Gateway** to address eight vulnerabilities, including two high-severity issues. The most serious flaw, **`CVE-2025-20229`**, can allow authenticated remote code execution through unauthorized file upload and execution, while **`CVE-2025-20231`** can expose sensitive data because session data and authentication tokens may be logged in plaintext and protected with improper permissions. Splunk documentation for managing app and add-on objects is relevant because the attack surface includes application components and uploaded objects within Splunk environments. The update also fixes several medium-severity weaknesses, including **CSRF**, an **SPL security bypass with command execution**, unauthorized access to sensitive data, and unauthorized system changes. Splunk further remediated vulnerabilities in bundled third-party components including **idna**, **certifi**, **requests**, **urllib3**, **cryptography**, **axios**, and **Jinja2**. Organizations using affected versions have been urged to upgrade promptly, and exposure from **`CVE-2025-20231`** can also be reduced by disabling the **Splunk Secure Gateway App** until patches are applied.
Jul 24, 2026
Splunk issued urgent fixes for **CVE-2026-20253**, a critical `CVSS 9.8` vulnerability in **Splunk Enterprise** that allows unauthenticated arbitrary file creation and truncation through a PostgreSQL sidecar service endpoint missing authentication controls. The flaw affects supported Splunk Enterprise releases prior to **10.4.0**, **10.2.4**, **10.0.7**, **9.4.12**, and **9.3.13** depending on branch, and Splunk said **Splunk Cloud is not affected** because it does not use Postgres sidecars. Splunk and national cyber authorities urged administrators to apply updates immediately, noting that no vendor detections or workarounds were initially available for the core issue. Public technical analysis from watchTowr Labs showed the bug can be reached through Splunk Web on port `8000`, which proxies requests to localhost-only PostgreSQL recovery endpoints, enabling attackers to abuse `/v1/postgres/recovery/backup` and `/restore` for filesystem access. Researchers demonstrated a full pre-auth exploitation chain that used path traversal, PostgreSQL connection-string injection, local `.pgpass` credentials, and PostgreSQL large-object export to gain arbitrary file write as the `splunk` user, then overwrite a Splunk Python script to achieve remote code execution. Splunk also disclosed additional Enterprise flaws including **CVE-2026-20251** (`CVSS 8.8`) in the Splunk Secure Gateway app due to unsafe `jsonpickle` deserialization, plus stored XSS and SSRF issues, prompting guidance to patch quickly, restrict dashboard creation and web exposure, and disable or remove vulnerable components where immediate upgrades are not possible.
Jul 23, 2026
Splunk disclosed and patched multiple vulnerabilities affecting **Splunk Enterprise**, **Splunk Cloud Platform**, and the **MCP Server** application, including two high-severity issues in its core platforms. The most serious, `CVE-2026-20204`, could allow a low-privileged user to achieve remote code execution by uploading a malicious file into the temporary application directory at `$SPLUNK_HOME/var/run/splunk/apptemp`, a weakness tied to improper temporary-file handling and insufficient isolation. Italian authorities also warned that newly identified flaws in Splunk products could expose sensitive information and allow arbitrary file writes on affected systems, urging organizations to review impacted version branches and apply vendor fixes.
Jul 30, 2026