CVE-2026-76293

Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise

State: Published
Severity: 7.2 High
Published: Oct 21, 2026
Updated: Oct 23, 2026
Reserved: Aug 19, 2026

Description

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-94 The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	10.4 to before 10.4.3Affected 10.2 to before 10.2.8Affected 10.0 to before 10.0.11Affected 9.4 to before 9.4.16Affected

References

https://advisory.splunk.com/advisories/SVD-2026-1007

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.