Threats Tagged 'cve-2026-76335'

Splunk heeft meerdere kwetsbaarheden verholpen in Splunk Enterprise, specifiek in versies vóór 10.4.2, 10.2.6, 10.0.9 en 9.4.14.

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user who does not hold a role with the edit_manager_xml capability could write a malicious Splunk Web Manager Extensible Markup Language (XML) configuration. When the same user opens the affected Splunk Web Manager page, Splunk Enterprise runs attacker-controlled operating-system commands as the user account running Splunk Enterprise. The vulnerability is possible because Splunk Web does not require the edit_manager_xml capability before accepting Splunk Web Manager XML configuration changes.

CVE-2026-76335 is a high-severity vulnerability in Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It allows an authenticated user without the edit_manager_xml capability to write malicious Splunk Web Manager XML configurations. When such a user accesses the affected Splunk Web Manager page, the system executes attacker-controlled operating system commands with the privileges of the Splunk Enterprise user account. This occurs because Splunk Web does not enforce the edit_manager_xml capability before accepting configuration changes, leading to improper neutralization of input that modifies code behavior.