CVE-2026-76314: The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. in Splunk Splunk Enterprise

CVE-2026-76314 affects Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. The vulnerability arises because Splunk Web evaluates manager XML expressions without adequate input validation, and the configuration route does not enforce the expected capability requirements for manager configuration changes. This flaw enables a user lacking 'admin' or 'power' roles to execute arbitrary code remotely by submitting crafted configuration content, potentially compromising confidentiality, integrity, and availability of the system.

An attacker with limited privileges (not holding 'admin' or 'power' roles) can exploit this vulnerability to execute arbitrary code remotely on the affected Splunk Enterprise system. This can lead to unauthorized access to all relevant data and impact system integrity and availability, representing a high-severity risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Splunk Web Manager Configuration interfaces to trusted users only and monitor for suspicious configuration changes. Follow Splunk's official documentation on configuration file management for best practices.