Splunk Enterprise <10.4.3: Arbitrary OS Cmd Exec via Edit_Manager_XML
CVE-2026-76293 Published on October 21, 2026
Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page.
The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.
Weakness Type
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2026-76293 has been classified to as a Code Injection vulnerability or weakness.
Products Associated with CVE-2026-76293
Want to know whenever a new CVE is published for Splunk? stack.watch will email you.
Affected Versions
Splunk Enterprise:- Version 10.4 and below 10.4.3 is affected.
- Version 10.2 and below 10.2.8 is affected.
- Version 10.0 and below 10.0.11 is affected.
- Version 9.4 and below 9.4.16 is affected.