CVE-2026-76293: The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. in Splunk Splunk Enterprise

This vulnerability arises because Splunk Web evaluates user-controlled expressions from Manager XML without adequately restricting the expression syntax. As a result, a user with the edit_manager_xml capability can inject and execute arbitrary OS commands under the Splunk Enterprise service account. The affected versions are all releases before 10.4.3, 10.2.8, 10.0.11, and 9.4.16. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with edit_manager_xml capability to execute arbitrary operating system commands with the privileges of the Splunk Enterprise service account. This can lead to full compromise of the host running Splunk Enterprise, including data theft, service disruption, or further lateral movement.

A fix is available in Splunk Enterprise versions 10.4.3, 10.2.8, 10.0.11, and 9.4.16. Users should upgrade to these versions or later to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary workarounds.