CVE-2026-76314: The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. in Splunk Splunk Enterprise

In Splunk Enterprise versions before 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a vulnerability exists where Splunk Web evaluates manager XML expressions without adequate input restrictions. Additionally, the configuration route does not enforce the expected capability requirements for manager configuration changes. This allows users lacking admin or power roles to submit specially crafted configuration content that leads to remote code execution, compromising system integrity, confidentiality, and availability.

An attacker with limited privileges (not admin or power roles) can execute arbitrary code remotely on the affected Splunk Enterprise system. This can lead to full compromise of the system, including unauthorized access to all relevant data and disruption of system availability.

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later, where this vulnerability is fixed. These versions implement proper input validation and enforce correct capability requirements for manager configuration changes. No other mitigation is indicated by the vendor advisory.