EUVD-2026-62900
GHSA-2c4w-mhg7-79mv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable Splunk Web requires authenticated low-privilege access (PR:L); attacker self-triggers execution by opening the page (UI:N); full OS command execution yields C:H/I:H/A:H.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated user who does not hold a role with the edit_manager_xml capability could write a malicious Splunk Web Manager Extensible Markup Language (XML) configuration. When the same user opens the affected Splunk Web Manager page, Splunk Enterprise runs attacker-controlled operating-system commands as the user account running Splunk Enterprise. The vulnerability is possible because Splunk Web does not require the edit_manager_xml capability before accepting Splunk Web Manager XML configuration changes.
AnalysisAI
Authenticated low-privilege code injection in Splunk Enterprise allows OS command execution on the host system as the Splunk process account. Affected versions span four active release lines (9.4.x, 10.0.x, 10.2.x, 10.4.x), and the root cause is a missing capability check: Splunk Web accepts Splunk Web Manager XML configuration writes without enforcing the edit_manager_xml permission, meaning any authenticated user can plant attacker-controlled content that executes when the Manager page is rendered. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated session to Splunk Web with at least a basic user-level role - the attacker must NOT hold the edit_manager_xml capability (meaning this targets lower-privileged users, not admins who already have it). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the threat surface: network-reachable, low complexity, requires only a low-privilege authenticated session, and yields full confidentiality, integrity, and availability impact on the Splunk host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Splunk analyst account without elevated permissions crafts a malicious Splunk Web Manager XML configuration embedding OS command directives and submits it via the unprotected endpoint, bypassing the missing edit_manager_xml capability check. The attacker then navigates to the affected Splunk Web Manager page in their own session, triggering server-side processing of the malicious XML and execution of arbitrary OS commands as the Splunk service account. … |
| Remediation | The primary fix is upgrading Splunk Enterprise to a patched release: 9.4.14 (for the 9.4.x branch), 10.0.9 (for the 10.0.x branch), 10.2.6 (for the 10.2.x branch), or 10.4.2 (for the 10.4.x branch), as documented in the Splunk advisory at https://advisory.splunk.com/advisories/SVD-2026-0801. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Splunk Enterprise instances running versions 9.4.x, 10.0.x, 10.2.x, or 10.4.x and catalog the number of users with Splunk access to measure breach exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today