Splunk Enterprise EUVD-2026-62900

Exploitation requires an active authenticated session to Splunk Web with at least a basic user-level role - the attacker must NOT hold the edit_manager_xml capability (meaning this targets lower-privileged users, not admins who already have it). The vulnerable endpoint is the Splunk Web Manager XML configuration write path, which must be network-reachable to the attacker. The attacker must then open the affected Splunk Web Manager page within their own session to trigger OS command execution; since the attacker controls this step themselves, UI:N in the CVSS vector is accurate. Exploitation is limited to: authenticated users only (unauthenticated access is not possible); Splunk Enterprise versions in the four affected branches (9.4.x before 9.4.14, 10.0.x before 10.0.9, 10.2.x before 10.2.6, 10.4.x before 10.4.2); and deployments where the attacker's account can reach the Splunk Web Manager interface. Splunk Cloud Platform scope is unconfirmed from available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the threat surface: network-reachable, low complexity, requires only a low-privilege authenticated session, and yields full confidentiality, integrity, and availability impact on the Splunk host. The PR:L requirement is the primary limiting factor - unauthenticated exploitation is not possible. However, in enterprise Splunk deployments, a large population of users (analysts, operators, contractors) typically holds basic authenticated access without edit_manager_xml, making the effective attacker population broad. No EPSS score was provided in the source data; this limits probabilistic exploitation forecasting. KEV status is not listed, and no public POC is identified at time of analysis, so the exploitation signal is currently limited to the vendor advisory. The self-triggered nature of the exploit (attacker opens the page themselves) means no victim interaction beyond the attacker's own session is required, which removes a practical friction point. This is a genuine high-priority issue for any multi-user Splunk Enterprise deployment, not a theoretical CVSS-inflated finding.

An authenticated Splunk analyst account without elevated permissions crafts a malicious Splunk Web Manager XML configuration embedding OS command directives and submits it via the unprotected endpoint, bypassing the missing edit_manager_xml capability check. The attacker then navigates to the affected Splunk Web Manager page in their own session, triggering server-side processing of the malicious XML and execution of arbitrary OS commands as the Splunk service account. No public exploit code has been identified at time of analysis, but the attack requires no complex tooling beyond authenticated HTTP access to the Splunk Web interface.