This vulnerability arises from insufficient access control in Splunk Web Manager's handling of XML configuration changes. Authenticated users lacking the edit_manager_xml capability can inject malicious XML configurations. Upon loading the affected manager page, Splunk Enterprise executes these configurations, resulting in arbitrary OS command execution under the Splunk Enterprise service account. The flaw is due to missing enforcement of the edit_manager_xml capability check prior to accepting configuration changes. The CVSS 3.1 score is 8.8 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with authenticated access but without the edit_manager_xml role can execute arbitrary operating system commands as the Splunk Enterprise user. This can lead to full compromise of the Splunk Enterprise host, including data theft, service disruption, or further lateral movement within the network.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to one of these versions to remediate the vulnerability. Since this is not a cloud service, patching the affected software is required. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.