CVE-2026-76293 Splunk CVE debrief

Who should care

Splunk Enterprise administrators and users with the edit_manager_xml capability should assess exposure and prioritize remediation based on their role and potential impact. This includes reviewing and updating Splunk Enterprise to patched versions, restricting the edit_manager_xml capability, and monitoring Splunk Web Manager page usage for suspicious activity. Additionally, defenders should verify and limit user-controlled expressions from Manager XML to

Why it matters

CVE-2026-76293 is a high-severity RCE vulnerability in Splunk Enterprise that requires verification of exposure and remediation priority. Defenders should assess exposure, verify and limit user-controlled expressions, and review and update to patched versions.

• Potential remote code execution requires verification from official sources
• Defenders should verify and limit user-controlled expressions from Manager XML
• Splunk Enterprise administrators should review and update to patched versions
• Exposure and compromise require verification from official sources

Technical summary

A user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.

Defensive priority

High

Recommended defensive actions

• Review and update Splunk Enterprise to versions 10.4.3, 10.2.8, 10.0.11, or 9.4.16, or later
• Restrict the edit_manager_xml capability to only necessary users
• Monitor Splunk Web Manager page usage for suspicious activity
• Verify and limit user-controlled expressions from Manager XML
• Confirm whether affected Splunk Enterprise deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Official CVE Program and NVD records detail a Remote Code Execution (RCE) vulnerability in Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16. A user with the edit_manager_xml capability can execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.