Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.
CVE-2026-76293
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-76293
Splunk Enterprise
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Splunk",
"modules": [
"Splunk Web"
],
"product": "Splunk Enterprise",
"versions": [
{
"status": "affected",
"version": "10.4",
"lessThan": "10.4.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "10.2",
"lessThan": "10.2.8",
"versionType": "custom"
},
{
"status": "affected",
"version": "10.0",
"lessThan": "10.0.11",
"versionType": "custom"
},
{
"status": "affected",
"version": "9.4",
"lessThan": "9.4.16",
"versionType": "custom"
}
]
}
]- Related CVEs
- CVE-2026-76293
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #52577 · Revision 1
- Added to Heist Feed
- Publisher date