Vulnerabilities

Splunk, Zoom Patch Severe Vulnerabilities

Critical- and high-severity flaws could be exploited to execute arbitrary shell commands or elevate privileges.

Ionut Arghire

Published

March 12, 2026

Splunk vulnerability patches

Splunk and Zoom this week announced security updates that resolve multiple critical- and high-severity vulnerabilities across their product portfolios.

Zoom has addressed a critical-severity flaw in Workplace for Windows that could allow unauthenticated, remote attackers to elevate their privileges over the network.

The issue impacts the Mail feature of the product and was addressed in Workplace for Windows version 6.6.0 and Workplace VDI Client for Windows versions 6.4.17, 6.5.15, and 6.6.10.

Additionally, Zoom rolled out patches for three high-severity security defects in certain Zoom Clients for Windows that could be exploited by local attackers to escalate their privileges.

Splunk on Wednesday released a fresh round of Splunk Enterprise updates that resolve dozens of issues, including five that are product-specific.

The most severe of these bugs is CVE-2026-20163 (CVSS score of 8.0), a high-severity flaw that could be exploited by attackers who already have high privileges on a vulnerable deployment to execute arbitrary shell commands through a REST endpoint.

Advertisement. Scroll to continue reading.

“This occurs because of insufficient input sanitization when previewing uploaded files before indexing them,” Splunk says.

The security defect was addressed in Splunk Enterprise versions 10.2.0, 10.0.4, 9.4.9, and 9.3.10, which also resolve three medium-severity flaws leading to XSS attacks, credential exposure, and sensitive information disclosure.

The updates also include fixes for dozens of CVEs in third-party packages used in Splunk Enterprise, including multiple Golang dependencies.

A fourth medium-severity issue that could lead to Observability Cloud API access token leakage was resolved in Splunk Enterprise versions 10.2.1 and 10.0.4.

Additionally, Splunk rolled out fixes for dozens of other vulnerabilities in third-party packages in Splunk AppDynamics, including multiple critical-severity flaws.

Splunk made no mention of any of these security defects being exploited in the wild. Additional information can be found on the company’s security advisories page.