Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then access all relevant data and affect system integrity and availability on the Splunk platform instance. The vulnerability is possible because Splunk Web Manager Configuration evaluates manager configuration values, and the Representational State Transfer (REST) API path for manager configuration does not require the permission that normally controls manager configuration writes. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) and restmap.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/restmap.conf) in the Splunk documentation.
Published: 2026-08-19
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw allows a user with a role other than admin or power to execute arbitrary code on a Splunk Enterprise instance by submitting crafted manager‑configuration values through the Web Manager Configuration interface. This code execution can read all private data, modify configurations, or disrupt availability, effectively compromising the confidentiality, integrity, and availability of the platform. The weakness is a classic code‑injection flaw (CWE‑94).

Affected Systems

The vulnerability is present in Splunk Enterprise installations running versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, specifically when the Splunk Web component and the Web Manager Configuration feature are enabled. Any instance that permits a non‑admin user to interact with Splunk Web is potentially affected. The remediation fixes are applied by upgrading to one of the fixed releases mentioned above.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be through the REST API underlying the Web Manager Configuration, which fails to enforce the necessary write‑permission checks. A knowledgeable attacker with web access and a low‑privilege account could supply a malicious configuration string to trigger code execution. Prompt application of the vendor patch or disabling Splunk Web is recommended to block exploitation.

Generated by OpenCVE AI on August 20, 2026 at 09:56 UTC.

Remediation

Vendor Solution

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14, or higher.

Vendor Workaround

The vulnerability affects instances with Splunk Web turned on. Turning Splunk Web off is a possible workaround. See [Disable unnecessary Splunk Enterprise components](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/install-splunk-enterprise-securely/disable-unnecessary-splunk-enterprise-components) and the [web.conf](https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/web.conf) configuration specification file for more information on turning off Splunk Web.

OpenCVE Recommended Actions

  • Upgrade Splunk Enterprise to a fixed release such as 10.4.2, 10.2.6, 10.0.9 or 9.4.14 or newer.
  • If upgrading is impractical, disable the Splunk Web component by configuring web.conf or following Splunk’s disabling‑components guidance.
  • Restrict write permissions for manager configuration in restmap.conf so that only admin or power roles can modify configuration values, enforcing proper role‑based access control.

Generated by OpenCVE AI on August 20, 2026 at 09:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Splunk splunk
CPEs cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
Vendors & Products Splunk splunk

Wed, 19 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Splunk
Splunk splunk Enterprise
Vendors & Products Splunk
Splunk splunk Enterprise

Wed, 19 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute arbitrary code on the Splunk platform instance through Splunk Web Manager Configuration. The user could then access all relevant data and affect system integrity and availability on the Splunk platform instance. The vulnerability is possible because Splunk Web Manager Configuration evaluates manager configuration values, and the Representational State Transfer (REST) API path for manager configuration does not require the permission that normally controls manager configuration writes. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) and restmap.conf (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/configuration-file-reference/10.2.0-configuration-file-reference/restmap.conf) in the Splunk documentation.
Title Code Injection through Splunk Web Manager Configuration in Splunk Enterprise
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Splunk Splunk Splunk Enterprise
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-08-27T16:24:56.592Z

Reserved: 2026-08-19T12:02:03.625Z

Link: CVE-2026-76315

cve-icon Vulnrichment

Updated: 2026-08-27T16:17:00.953Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-19T22:17:15.370

Modified: 2026-08-27T17:20:09.287

Link: CVE-2026-76315

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T10:00:07Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')