CVE-2026-76335

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14

Description An authenticated user lacking the edit manager xml capability can write a malicious Splunk Web Manager Extensible Markup Language (XML) configuration. This occurs because Splunk Web fails to verify the edit manager xml capability before accepting configuration changes. When the user subsequently opens the affected Splunk Web Manager page, the system executes attacker-controlled operating-system commands under the context of the account running Splunk Enterprise.

Recommendations Update to version 10.4.2 or later. Update to version 10.2.6 or later. Update to version 10.0.9 or later. Update to version 9.4.14 or later.