CVE-2026-76335: The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. in Splunk Splunk Enterprise

The vulnerability arises from Splunk Enterprise constructing code segments using externally influenced input from an upstream component without proper neutralization of special elements. Authenticated users lacking the edit_manager_xml role can inject malicious XML configurations into Splunk Web Manager. Upon opening the affected page, these configurations cause execution of arbitrary OS commands as the Splunk Enterprise user. This flaw affects versions >=9.4 <9.4.14, >=10.0 <10.0.9, >=10.2 <10.2.6, and >=10.4 <10.4.2.

Successful exploitation allows an authenticated user with limited privileges to execute arbitrary operating system commands with the permissions of the Splunk Enterprise service account. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts.

A fix is available in Splunk Enterprise versions 9.4.14, 10.0.9, 10.2.6, and 10.4.2. Users should upgrade to these or later versions to remediate the vulnerability. No alternative mitigations are specified in the advisory.