Splunk Enterprise CVE-2026-76293

Exploitation requires an authenticated Splunk Web user whose role includes the edit_manager_xml capability (an administrative-grade capability), and the attacker must open the affected configuration in the Splunk Web Manager page so that Splunk Web evaluates the attacker-controlled Manager XML expression. The decisive limiting factor is this high-privilege prerequisite (PR:H): environments that restrict edit_manager_xml to trusted administrators sharply reduce the attacker population, whereas over-broad role assignments expand it. Affected only on Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16; no end-user interaction by a third party is needed (UI:N), and the attacker's own Web Manager access drives the exploit.

This is a genuine but conditionally-gated risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH) tells a coherent story: the flaw is reachable over the network through Splunk Web with low attack complexity and no user interaction, but it requires high privileges (PR:H) - specifically a role carrying the edit_manager_xml capability, which is an administrative-grade capability not held by ordinary users. The CWE-94 (code injection) classification aligns with the full C:H/I:H/A:H impact, since successful exploitation yields arbitrary OS command execution as the Splunk service account. No EPSS score, CISA KEV listing, or SSVC decision data was supplied in the input, and no public exploit code is referenced, so there is no evidence of active or automatable exploitation. The practical priority is therefore driven by the privilege prerequisite: in environments where edit_manager_xml is tightly held, this is primarily a privilege-escalation / trust-boundary issue (admin-ish Web user to OS-level RCE); where that capability is over-granted, risk rises materially. Signals are internally consistent - no CVSS-vs-description conflict - but note the absence of exploitation-probability data (no EPSS/KEV/POC provided), so real-world exploitation likelihood cannot be quantified from this input alone.

An attacker who has obtained (or escalated into) a Splunk role carrying the edit_manager_xml capability crafts a malicious configuration containing a user-controlled expression and opens it in the Splunk Web Manager page, where Splunk Web evaluates the expression without sufficient syntax restriction. The evaluation triggers execution of arbitrary operating-system commands under the privileges of the account running Splunk Enterprise, converting elevated Web access into host-level code execution. No public exploit code is referenced in the available data.