CVE-2026-76315: The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. in Splunk Splunk Enterprise

CVE-2026-76315 affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability arises from insufficient permission checks on the REST API path for manager configuration, which allows users lacking 'admin' or 'power' roles to execute arbitrary code through Splunk Web Manager Configuration. This flaw is due to the evaluation of manager configuration values without enforcing the permission that normally controls manager configuration writes, leading to potential full compromise of the Splunk platform instance.

An attacker with a non-privileged Splunk user account can execute arbitrary code on the Splunk platform instance, potentially accessing all relevant data and impacting system integrity and availability. This elevates the risk of data breaches, unauthorized data manipulation, and denial of service conditions within the affected Splunk environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted personnel only and monitor for unusual activity related to Splunk Web Manager Configuration. Follow Splunk's documentation on role-based user access and configuration management to minimize exposure.