CVE-2026-76293

HighCVSS 7.2/10Last modified Oct 23, 2026

Description

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page. The vulnerability is possible because Splunk Web evaluates user-controlled expressions from Manager XML without sufficiently restricting the expression syntax.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 23, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-762944.3In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could CVE-2026-762954.3In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.7 CVE-2026-762964.3In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could CVE-2026-762974.2In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with t CVE-2026-762988.8In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the Postgre CVE-2026-762999.9As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-76307.3A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of th CVE-2026-76300As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-76301As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-763029.9As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie CVE-2026-763035.7In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that CVE-2026-763044.3In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could downloa