{"api_version":"1","generated_at":"2026-10-23T08:12:54+00:00","cve":"CVE-2026-76293","urls":{"html":"https://cve.report/CVE-2026-76293","api":"https://cve.report/api/cve/CVE-2026-76293.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-76293","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76293"},"summary":{"title":"Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise","description":"In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. \nThe vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.","state":"PUBLISHED","assigner":"cisco","published_at":"2026-10-21 23:17:27","updated_at":"2026-10-23 04:18:17"},"problem_types":["CWE-94","CWE-94 The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment."],"metrics":[{"version":"3.1","source":"psirt@cisco.com","type":"Secondary","score":"7.2","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.2","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2026-1007","name":"https://advisory.splunk.com/advisories/SVD-2026-1007","refsource":"psirt@cisco.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76293","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76293","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Splunk","product":"Splunk Enterprise","version":"affected 10.4 10.4.3 custom","platforms":[]},{"source":"CNA","vendor":"Splunk","product":"Splunk Enterprise","version":"affected 10.2 10.2.8 custom","platforms":[]},{"source":"CNA","vendor":"Splunk","product":"Splunk Enterprise","version":"affected 10.0 10.0.11 custom","platforms":[]},{"source":"CNA","vendor":"Splunk","product":"Splunk Enterprise","version":"affected 9.4 9.4.16 custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Jasper Westerman","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"76293","cve":"CVE-2026-76293","epss":"0.003410000","percentile":"0.264010000","score_date":"2026-10-22","updated_at":"2026-10-23 00:07:29"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-76293","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-22T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-23T03:55:21.204Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"modules":["Splunk Web"],"product":"Splunk Enterprise","vendor":"Splunk","versions":[{"lessThan":"10.4.3","status":"affected","version":"10.4","versionType":"custom"},{"lessThan":"10.2.8","status":"affected","version":"10.2","versionType":"custom"},{"lessThan":"10.0.11","status":"affected","version":"10.0","versionType":"custom"},{"lessThan":"9.4.16","status":"affected","version":"9.4","versionType":"custom"}]}],"credits":[{"lang":"en","value":"Jasper Westerman"}],"datePublic":"2026-10-21T00:00:00.000Z","descriptions":[{"lang":"en","value":"In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. \nThe vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax."}],"metrics":[{"cvssV3_1":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","description":"The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","lang":"en","type":"cwe"}]}],"providerMetadata":{"dateUpdated":"2026-10-21T22:51:55.643Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2026-1007"}],"solutions":[{"lang":"en","value":"Upgrade Splunk Enterprise to versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 or higher."}],"source":{"advisory":"SVD-2026-1007","discovery":""},"title":"Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise"}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2026-76293","datePublished":"2026-10-21T22:51:55.643Z","dateReserved":"2026-08-19T12:02:03.622Z","dateUpdated":"2026-10-23T03:55:21.204Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-21 23:17:27","lastModifiedDate":"2026-10-23 04:18:17","problem_types":["CWE-94","CWE-94 The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment."],"metrics":{"cvssMetricV31":[{"source":"psirt@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-22T00:00:00+00:00","id":"CVE-2026-76293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"76293","Ordinal":"1","Title":"Remote Code Execution (RCE) through Splunk Web Manager Extensibl","CVE":"CVE-2026-76293","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"76293","Ordinal":"1","NoteData":"In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. \nThe vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.","Type":"Description","Title":"Remote Code Execution (RCE) through Splunk Web Manager Extensibl"}]}}}