CVE-2026-76315: Code Injection through Splunk Web Manager Configuration in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then access all relevant data and affect system integrity and availability on the Splunk platform instance. The vulnerability is possible because Splunk Web Manager Configuration evaluates manager configuration values, and the Representational State Transfer (REST) API path for manager configuration does not require the permission that normally controls manager configuration writes. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) and restmap.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/restmap.conf) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.2 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.6 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.9 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.14
Event History
Frequently Asked Questions
Which users can exploit this issue?
A Splunk user who does not have the admin or power role can exploit the issue. Exploitation relies on the REST API path for manager configuration not enforcing the permission that normally controls manager configuration writes.
What access does an attacker need before exploitation?
The attacker needs an existing Splunk user account with a role other than admin or power. No user interaction is required, and the vulnerability is remotely reachable according to the supplied vector.
What is the likely impact of successful exploitation?
An attacker can execute arbitrary code on the Splunk platform instance. They could access relevant data and affect the instance's integrity and availability.
Which releases are affected?
Splunk Enterprise releases below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected.