All vulnerabilities
CVE-2026-76293

Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise

Splunk Splunk EnterpriseApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.4.3Also 10.2.8, 10.0.11 and 1 moreCVE List
Published21 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.

Text from CVE List

Affected versions 4

  • Splunk Enterpriseaffected: 10.4 before 10.4.3CVE List
  • Splunk Enterpriseaffected: 10.2 before 10.2.8CVE List
  • Splunk Enterpriseaffected: 10.0 before 10.0.11CVE List
  • Splunk Enterpriseaffected: 9.4 before 9.4.16CVE List

References 1