Code Injection in Splunk Enterprise - CVE-2026-76293
Published: October 22, 2026
Vulnerability identifier: #VU156977
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76293
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary operating system commands with the permissions of the account running Splunk Enterprise.
The vulnerability exists due to code injection in Splunk Web Manager XML expression evaluation when opening an affected configuration in the Manager page. A remote privileged user can use the edit_manager_xml capability to supply expressions with insufficiently restricted syntax and open the configuration to execute arbitrary operating system commands as the account running Splunk Enterprise.
Affected software
Splunk Enterprise
How to mitigate CVE-2026-76293
Install security update from vendor's website.
Splunk Enterprise - addressed in versions 9.4.16, 10.0.11, 10.2.8, 10.4.4