Arbitrary Command Execution in Splunk Enterprise by Unauthorized Users
CVE-2026-76293

7.2HIGH

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Vendor
CVE Published:
21 October 2026

What is CVE-2026-76293?

In Splunk Enterprise, users with the edit_manager_xml capability can execute arbitrary operating-system commands through user-controlled expressions. This issue arises because Splunk Web does not adequately restrict the syntax of these expressions when evaluated from Manager XML. Affected users can access the vulnerable configuration via the Splunk Web Manager page, leading to potential unauthorized command execution in the context of the Splunk process.

Affected Version(s)

Splunk Enterprise 10.4 < 10.4.3

Splunk Enterprise 10.2 < 10.2.8

Splunk Enterprise 10.0 < 10.0.11

References

https://advisory.splunk.com/advisories/SVD-2026-1007

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jasper Westerman
.