An authenticated code injection vulnerability in Splunk Enterprise allows attackers with low privileges to achieve remote code execution.

This is a code injection vulnerability (CWE-94) where the application improperly handles user input during code construction. The vulnerability requires the attacker to have low-level privileges (PR:L) to successfully execute arbitrary commands on the underlying system.

The ability to execute arbitrary code provides an attacker with full control over the Splunk Enterprise instance. This poses a significant risk of data exfiltration, lateral movement within the network, and complete compromise of internal security monitoring operations. The CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability.

Immediate Action: Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, 9.4.14, or higher to apply the security patch.

Proactive Monitoring: Monitor system logs for unusual process execution or attempts to access restricted directories by low-privileged user accounts.

Compensating Controls: Ensure strict access control lists are in place to limit user permissions, and employ network segmentation to isolate the Splunk instance from critical internal assets.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability represents a severe threat to the integrity of security operations. Administrators must prioritize the application of the vendor-supplied patches to all affected Splunk Enterprise instances to prevent unauthorized system access.