CVE-2026-76335: Splunk Enterprise RCE Vulnerability

CVE-2026-76335 Overview

CVE-2026-76335 is a command injection vulnerability [CWE-94] in Splunk Enterprise. The flaw allows an authenticated user without the edit_manager_xml capability to write a malicious Splunk Web Manager Extensible Markup Language (XML) configuration. When the same user later opens the affected Splunk Web Manager page, Splunk Enterprise executes attacker-controlled operating system commands under the account running the Splunk service. The vulnerability exists because Splunk Web fails to enforce the edit_manager_xml capability check before accepting XML configuration changes. Affected releases include Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.

Critical Impact
An authenticated low-privilege user can achieve arbitrary command execution as the Splunk service account, compromising confidentiality, integrity, and availability of the Splunk deployment.

Affected Products

Splunk Enterprise versions below 10.4.2
Splunk Enterprise versions below 10.2.6
Splunk Enterprise versions below 10.0.9 and 9.4.14

Discovery Timeline

2026-08-19 - CVE-2026-76335 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76335

Vulnerability Analysis

The vulnerability resides in the Splunk Web Manager interface, which processes XML configuration submissions used to define manager pages and their behaviors. Splunk exposes a capability model where edit_manager_xml is intended to gate any user permitted to modify manager-level XML content. In vulnerable builds, the endpoint accepting XML changes does not verify the capability before persisting the payload. An authenticated user with limited role assignments can therefore inject XML directives that are later parsed and rendered by the Manager. When a user with access to the affected page loads it, the malicious XML is evaluated in a context that permits shell command execution as the operating system user that runs the Splunk process.

Root Cause

The root cause is a missing authorization check [CWE-94]. Splunk Web accepts XML configuration modifications without confirming that the submitting principal holds the edit_manager_xml capability, breaking the principle that privileged configuration primitives must require privileged capabilities.

Attack Vector

Exploitation requires network access to Splunk Web and valid authenticated credentials for a low-privilege account. The attacker submits a crafted XML configuration to a Splunk Web Manager endpoint. The payload is stored in the manager configuration. When the attacker or another authorized viewer loads the affected Manager page, the server-side rendering path processes the XML and invokes OS commands defined by the attacker. Execution runs with the privileges of the Splunk service account, which typically has broad access to indexed data, apps, and local resources.

See the Splunk Security Advisory SVD-2026-0801 for vendor technical details.

Detection Methods for CVE-2026-76335

Indicators of Compromise

Unexpected modifications to Splunk Web Manager XML configuration files under $SPLUNK_HOME/etc/ written by non-administrative user accounts.
Child processes spawned by the Splunk service (splunkd, splunkweb) that invoke shell interpreters such as /bin/sh, bash, cmd.exe, or powershell.exe.
Audit log entries in _audit index showing manager XML edits by users lacking the edit_manager_xml capability.

Detection Strategies

Baseline expected Splunk service child processes and alert on deviations, especially shell and scripting engines launched from the Splunk installation directory.
Search Splunk audit logs for action=edit events targeting manager XML resources correlated against the role capability set of the acting user.
Monitor file integrity on $SPLUNK_HOME/etc/apps/*/local/data/ui/manager/*.xml for unauthorized writes.

Monitoring Recommendations

Enable and forward Splunk internal _audit and _internal indexes to a central SIEM for correlation across users and hosts.
Alert on any process ancestry where splunkd or splunkweb spawns interactive shells or download utilities such as curl, wget, or certutil.
Track authentication of low-privilege Splunk accounts followed by manager XML write activity within a short time window.

How to Mitigate CVE-2026-76335

Immediate Actions Required

Upgrade Splunk Enterprise to 10.4.2, 10.2.6, 10.0.9, 9.4.14, or later as applicable to your release train.
Audit role assignments and remove unnecessary access to Splunk Web for accounts that do not require it.
Review the _audit index for prior manager XML modifications performed by users without the edit_manager_xml capability.

Patch Information

Splunk has released fixed versions that enforce the edit_manager_xml capability check before accepting XML configuration changes. Refer to Splunk Security Advisory SVD-2026-0801 for the complete list of patched builds and download instructions.

Workarounds

Restrict network access to Splunk Web to trusted administrative networks using firewall or reverse proxy controls.
Disable Splunk Web on indexers and other roles that do not require the management UI by setting startwebserver = 0 in web.conf.
Run the Splunk service under a dedicated low-privilege operating system account to limit the blast radius of command execution.

bash

# Example web.conf hardening on non-search-head instances
# $SPLUNK_HOME/etc/system/local/web.conf
[settings]
startwebserver = 0