{"id":"CVE-2026-76293","kind":"vulnerability","aliases":["CVE-2026-76293"],"related":[],"title":"Splunk Enterprise: low-privilege users can run OS commands via Manager XML","description":"In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. \nThe vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.","summary":"Splunk Web evaluates user-controlled expressions in Manager XML without restricting the syntax, so a user with the edit_manager_xml capability can run arbitrary operating-system commands. The commands run with the permissions of the account that runs Splunk Enterprise.","severity":"high","cvss":7.2,"epss":0.00341,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","on-prem-logging","self-hosted","splunk"],"not_affected_if":["no-edit_manager_xml-roles","patched-version"],"how_to_check":"- Check the installed version with `splunk version` and compare it against the fixed releases listed below.\n- Review which roles hold the `edit_manager_xml` capability, for example in Settings > Roles or in `authorize.conf`.","fix":"- Upgrade Splunk Enterprise to `10.4.3`, `10.2.8`, `10.0.11`, or `9.4.16`, matching your release line.\n- Remove the `edit_manager_xml` capability from roles that do not need it until the upgrade is applied.","status":"open","published_at":"2026-10-21T23:17:27+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:29:01+00:00","updated_at":"2026-10-25T03:29:01+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:29:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Splunk Enterprise to `10.4.3`, `10.2.8`, `10.0.11`, or `9.4.16`, matching your release line.\n- Remove the `edit_manager_xml` capability from roles that do not need it until the upgrade is applied.","reach":"network","title":"Splunk Enterprise: low-privilege users can run OS commands via Manager XML","impact":"high","summary":"Splunk Web evaluates user-controlled expressions in Manager XML without restricting the syntax, so a user with the edit_manager_xml capability can run arbitrary operating-system commands. The commands run with the permissions of the account that runs Splunk Enterprise.","category":"infrastructure","nicknames":[],"who_cares":["splunk","self-hosted","on-prem-logging"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs OS commands as the Splunk service account.","analyst_note":"Confirm whether edit_manager_xml is granted to any default role and whether a public advisory or proof of concept exists beyond the NVD entry.","how_to_check":"- Check the installed version with `splunk version` and compare it against the fixed releases listed below.\n- Review which roles hold the `edit_manager_xml` capability, for example in Settings > Roles or in `authorize.conf`.","needs_analyst":true,"not_affected_if":["patched-version","no-edit_manager_xml-roles"],"who_is_affected":"Deployments running Splunk Enterprise below the fixed versions where some users hold a role with the edit_manager_xml capability. An attacker needs an account with that capability, so instances where only administrators can log in are at lower risk. unknown whether the sources list a default role that includes the capability.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":3439,"output_tokens":636,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-76293':16A,19A '10.0.11':79C '10.2.8':78C '10.4.3':77C '9.4.16':81C 'account':67B,107C 'affect':114C 'arbitrari':54B,96C 'capabl':51B,93C 'command':10A,58B,60B,100C 'configur':115C 'control':34B,132C 'could':94C 'cve':14A,17A 'edit':48B,90C 'enterpris':2A,71B,74C,110C 'evalu':31B,129C 'execut':95C 'express':35B,133C,141C 'hold':85C 'host':27B 'infrastructur':20B 'log':24B 'low':4A 'low-privileg':3A 'manag':12A,37B,49B,91C,120C,135C 'on-prem-log':21B 'open':112C 'oper':56B,98C 'operating-system':55B,97C 'os':9A 'page':121C 'permiss':64B,103C 'possibl':125C 'prem':23B 'privileg':5A 'restrict':40B,139C 'role':87C 'run':8A,53B,61B,69B,108C 'self':26B 'self-host':25B 'splunk':1A,28B,29B,70B,73C,109C,118C,127C 'suffici':138C 'syntax':42B,142C 'system':57B,99C 'use':101C 'user':6A,33B,45B,83C,106C,131C 'user-control':32B,130C 'version':75C 'via':11A 'vulner':123C 'web':30B,119C,128C 'without':39B,137C 'xml':13A,38B,50B,92C,136C","nicknames":[],"mitigations":[],"who_affected":"Deployments running Splunk Enterprise below the fixed versions where some users hold a role with the edit_manager_xml capability. An attacker needs an account with that capability, so instances where only administrators can log in are at lower risk. unknown whether the sources list a default role that includes the capability.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76293","severity":null,"published_at":"2026-10-21T23:17:27+00:00","modified_at":"2026-10-23T04:18:17+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76293","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76293","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}