Splunk patches 24 flaws, four critical, in Enterprise and SOAR
October 21 fixes cover CVSS 9.9 bugs; Secure Gateway also needs updates for two CVEs.
62
CVE-2026-76293
Authenticated OS command injection in Splunk Enterprise Manager XML
- CVSS 3.1
- 7.2 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
In Splunk Enterprise, Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting expression syntax. A user whose role includes the edit_manager_xml capability can trigger this over the network, without further user interaction, by opening the affected configuration in the Splunk Web Manager page and run arbitrary operating-system commands as the account running Splunk Enterprise. Deployments below the fixed releases are affected.
What to do: Upgrade Splunk Enterprise to 10.4.3, 10.2.8, 10.0.11, or 9.4.16, matching the installed release line.
| Product | Affected | Fixed in |
|---|---|---|
| Splunk Enterprise | below 10.4.3, 10.2.8, 10.0.11, and 9.4.16 | 10.4.3, 10.2.8, 10.0.11, and 9.4.16 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.