CVE-2026-76315: The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. in Splunk Splunk Enterprise

This vulnerability arises because Splunk Web Manager Configuration evaluates manager configuration values constructed from externally-influenced input without properly neutralizing special elements that could alter code syntax or behavior. Additionally, the REST API path for manager configuration does not enforce the permission controls that normally restrict manager configuration writes. As a result, users lacking admin or power roles can execute arbitrary code on the Splunk platform instance, potentially affecting confidentiality, integrity, and availability.

An attacker with limited privileges (not holding admin or power roles) can exploit this vulnerability to execute arbitrary code on the Splunk platform instance. This leads to unauthorized access to all relevant data and can compromise system integrity and availability, posing a significant security risk.

Splunk has released official fixes in versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated beyond applying these updates.