CVE-2026-76314

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description A user without admin or power roles can achieve Remote Code Execution (RCE) by submitting crafted Splunk Web Manager Configuration content. This occurs because Splunk Web evaluates manager Extensible Markup Language (XML) expressions without sufficient input restrictions, and the configuration route lacks the required capability checks for manager configuration changes. Successful exploitation allows unauthorized access to data and impacts system integrity and availability.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.