Description

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution (RCE) by submitting crafted Splunk Web Manager Configuration content. The user could then access all relevant data and affect system integrity and availability. The vulnerability is possible because Splunk Web evaluates manager Extensible Markup Language expressions without sufficient input restrictions, and the associated configuration route does not require the capability expected for manager configuration changes. For more information see About configuration files (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.4/administer-splunk-enterprise-with-configuration-files/about-configuration-files) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T22:17:15.250Z",
  "pubdate": "2026-08-19T22:17:15.250Z",
  "executiveSummary": "Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 contain a Remote Code Execution (RCE) vulnerability within Splunk Web. The flaw allows authenticated users lacking the \"admin\" or \"power\" Splunk roles to achieve remote code execution by submitting crafted Splunk Web Manager Configuration content.\nSuccessful exploitation compromises the entire affected system, granting the adversary the ability to access all relevant data and severely impacting confidentiality, system integrity, and availability. The attack vector is driven by insufficient input restrictions during the evaluation of manager Extensible Markup Language expressions combined with a lack of capability enforcement on the associated configuration route.\nThe vulnerability requires an authenticated user with low privileges to interact with the vulnerable Splunk Web interface and submit malicious configuration payloads. Risk implications are severe, as unauthorized execution of arbitrary code leads to complete system takeover within enterprise environments. Remediation requires updating Splunk Enterprise to the designated patched versions or applying vendor-provided configuration adjustments as outlined in the official documentation.",
  "technicalDetails": "The vulnerability resides in the Splunk Web component of Splunk Enterprise, specifically within the processing and evaluation logic handling manager Extensible Markup Language expressions. The root cause stems from two distinct security deficiencies: the absence of sufficient input validation and restrictions when evaluating manager Extensible Markup Language expressions, and the failure of the associated configuration route to enforce the administrative capabilities typically required for manager configuration changes.\nAffected products and versions include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. While authentication is required to access the interface, the privilege requirements are circumvented by the vulnerability design; users who do not hold the \"admin\" or \"power\" Splunk roles are able to interact with the vulnerable configuration route.\nThe attack flow proceeds as follows: an authenticated low-privileged user crafts malicious Splunk Web Manager Configuration content containing arbitrary Extensible Markup Language expressions designed to trigger code execution. The attacker submits this payload via the vulnerable configuration route. Because the endpoint does not properly validate the input or enforce the expected capability checks required for manager configuration changes, the Splunk Web component evaluates the malicious Extensible Markup Language expressions without adequate restrictions.\nUpon evaluation of the crafted input, the underlying system executes the embedded payload, achieving Remote Code Execution in the context of the user running the Splunk Enterprise service. Post-exploitation impact includes unauthorized access to all relevant data processed or stored by Splunk Enterprise, persistent compromise of host integrity, and disruption of system availability."
}