CVE-2026-76335: Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user who does not hold a role with the editmanagerxml capability could write a malicious Splunk Web Manager Extensible Markup Language (XML) configuration. When the same user opens the affected Splunk Web Manager page, Splunk Enterprise runs attacker-controlled operating-system commands as the user account running Splunk Enterprise. The vulnerability is possible because Splunk Web does not require the editmanagerxml capability before accepting Splunk Web Manager XML configuration changes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.4.2 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.2.6 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 10.0.9 - Upgrade
Upgrade
Splunk Enterpriseto a version that resolves this vulnerability.Fixed in 9.4.14
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Splunk Enterprise user can exploit it even if they do not have the edit_manager_xml capability. Exploitation requires access to submit Splunk Web Manager XML configuration changes and then open the affected Splunk Web Manager page.
What level of access does successful exploitation provide?
Attacker-controlled operating-system commands run as the user account that runs Splunk Enterprise. This can affect confidentiality, integrity, and availability of the host at the privilege level of that account.
Which versions require remediation?
Affected versions are Splunk Enterprise releases below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Updating to the applicable listed release or later addresses the affected version ranges.
What can be done if patching cannot happen immediately?
The provided information identifies authenticated users and Splunk Web Manager XML configuration changes as prerequisites. Restricting access to accounts that can use Splunk Web Manager and monitoring or limiting XML configuration changes can reduce exposure, though no specific vendor workaround is provided.