Authenticated RCE via manager XML configuration

Code injection in Splunk Enterprise before 10.4.2, 10.2.6, 10.0.9, and 9.4.14 allows authenticated users to execute OS commands. Splunk Web Manager accepts manager XML configuration changes without requiring the edit_manager_xml capability, then evaluates XML expressions from that stored configuration when the attacker opens the affected manager page. Reachability requires a valid Splunk account and Splunk Web to be enabled; successful exploitation runs commands as the Splunk Enterprise service account and can read, modify, or disrupt accessible data and services.