Loading story…
Splunk documented and later retired a detection for unauthorized POST requests to the /services/indexing/preview REST endpoint after the underlying RBAC-bypass vulnerabilities were patched in current releases. The analytic watched Splunk's _internal index for attempts to abuse the endpoint, which could allow a user without proper authorization to interact with indexing preview functions tied to an existing search job.
Successful exploitation could let an attacker who knew a valid search ID overwrite search results, manipulate visible data, and gain unauthorized access to sensitive information, undermining the integrity of Splunk investigations and reporting. Separately, MITRE ATT&CK catalogs Access Token Manipulation as Windows privilege-escalation technique T1134, including abuse of privileges such as SeDebugPrivilege and SeImpersonatePrivilege, but the Splunk issue itself centers on application-layer authorization bypass rather than host-level token theft.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the hunting detection "Splunk RBAC Bypass On Indexing Preview REST Endpoint" from its content library because the associated CVEs had been patched in the latest Splunk release. The removal is noted as part of content library version 5.6.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk removed a hunting analytic after the underlying vulnerabilities were patched in current releases, but the detection documented how low-privilege users could attempt to access hashed Splunk passwords through the `conf-user-seed` REST endpoint. The analytic monitored `splunkd_web` access logs for requests to that endpoint because such activity could expose credential material and support privilege escalation to full administrative control of a Splunk instance. The activity was mapped to MITRE ATT&CK technique `T1212` (**Exploitation for Credential Access**), which covers abuse of software flaws to obtain credentials or bypass authentication controls. MITRE notes that this class of exploitation can enable forged authentication artifacts, replayed authentication traffic, unintended token creation or renewal in cloud environments, and broader privilege escalation when credentialing systems are affected.
Aug 12, 2026
Splunk disclosed a high-severity **remote command execution (RCE)** vulnerability, **CVE-2026-20163** (CVSS **8.0**), affecting *Splunk Enterprise* and *Splunk Cloud Platform*. The issue is a **command injection** weakness (CWE-77) in the REST endpoint `/splunkd/__upload/indexing/preview`, where user-controlled input is insufficiently sanitized during the “uploaded file preview before indexing” workflow. Exploitation requires an authenticated user whose role includes the high-privilege capability `edit_cmd`; under that condition, an attacker can abuse the `unarchive_cmd` parameter to execute arbitrary shell commands on the underlying host. Reported affected versions include Splunk Enterprise **10.0.0–10.0.3**, **9.4.0–9.4.8**, and **9.3.0–9.3.9**, plus Splunk Cloud Platform versions below **10.2.2510.5**, **10.1.2507.16**, **10.0.2503.12**, and **9.3.2411.124**; fixed thresholds are Enterprise **10.0.4**, **9.4.9**, **9.3.10**, and **10.2.0** (with the base Enterprise **10.2** release noted as not affected). The disclosure credits researcher **Danylo Dmytriiev (DDV_UA)** along with Splunk personnel **Gabriel Nitu** and **James Ervin**.
Jun 29, 2026
Splunk documented and later removed a detection for privilege escalation in which low-privilege users could abuse the `edit_user` capability to obtain administrative access. The analytic monitored `_audit` logs for password-related actions including `change_own_password`, `password_change`, and `edit_password` when access was granted to accounts that were not administrators or system users, and warned that successful exploitation could result in full control of the Splunk environment and potential data exposure. The detection was mapped to MITRE ATT&CK technique **T1548: Abuse Elevation Control Mechanism**, which covers privilege escalation and defense evasion through misuse of built-in control mechanisms across platforms. Splunk marked the analytic as deprecated and removed it after the underlying issue, tracked as **`CVE-2023-32707`**, was patched in current releases, noting the detection had been disabled by default, required access to the `_audit` index, and could produce false positives during legitimate password changes.
Aug 12, 2026