A user with the edit_manager_xml capability in Splunk Enterprise can execute arbitrary operating‑system commands by opening a specific configuration page in Splunk Web Manager. The flaw arises because expressions in Manager XML are evaluated without sufficient syntax restrictions, enabling command injection. Successful exploitation grants full control over the Splunk instance, compromising confidentiality, integrity, and availability of all data and services running on the affected host.

Splunk Enterprise deployments running any version earlier than 10.4.3, 10.2.8, 10.0.11, or 9.4.16 are vulnerable when a user is assigned the edit_manager_xml capability. The vulnerability is limited to those accounts that can access the Web Manager configuration interface.

The CVSS score of 7.2 indicates moderate to high severity, but the EPSS score is currently unavailable, suggesting no publicly known exploitation at this time. The flaw does not appear in the CISA KEV catalog. Attackers would need to compromise or create an account with the edit_manager_xml role, or exploit existing privileged credentials, to launch the attack. Once in place, the vulnerability can be used to run arbitrary OS commands with the service account’s privileges, potentially giving full root access to the host.