Splunk systems are at risk from a remote command execution (RCE) vulnerability.

Tracked as CVE-2026-20163, the flaw allows bad actors to carry out arbitrary shell commands directly on the host operating system.

Affecting Splunk Enterprise and Splunk Cloud Platform, the vulnerability stems from use of the unarchive command option in Splunk’s upload preview interface, due to insufficient input sanitization when previewing uploaded files before being indexed.

The issue was marked with a high CVSS severity score of 8.0. To solve the bug, Splunk advised users to upgrade Splunk Enterprise to versions 10.2.0, 10.0.4, 9.4.9, 9.3.10, or higher.

Splunk added it is actively monitoring and patching Splunk Cloud Platform instances.

The RCE issue follows another Splunk Enterprise flaw dating to October, with a flaw in the data management platform that opened up the system to blind server-side request forgery (SSRF). Unlike a typical SSRF where an attacker tricks a server into making network requests on their behalf, in a blind attack the actor cannot see the response from the request the server makes, having to instead infer the result.

Hackers could exploit the issue to force the Splunk server to send HTTP requests to arbitrary destinations via a vulnerable REST API parameter, potentially allowing access to internal services that accept requests originating from the server.